PT-2017-10698
CVE-2017-0897
·
تاريخ النشر
2017-06-22
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
ExpressionEngine versions 2.x through 2.11.7
ExpressionEngine versions 3.x through 3.5.4
Description
The issue allows for the creation of an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.
Recommendations
For ExpressionEngine versions 2.x through 2.11.7, update to version 2.11.8 or later.
For ExpressionEngine versions 3.x through 3.5.4, update to version 3.5.5 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾