PT-2017-11445
CVE-2017-10711
·
تاريخ النشر
2017-07-24
·
تاريخ التحديث
2017-08-10
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
SimpleRisk version 20170614-001
Description
A CSRF attack on the 'reset.php' endpoint, specifically the Send Password Reset Email form, can insert XSS sequences via the
user parameter.Recommendations
For version 20170614-001, consider disabling the Send Password Reset Email form temporarily until a patch is available to prevent CSRF attacks that could lead to XSS sequence insertion. Restrict access to the 'reset.php' endpoint to minimize the risk of exploitation. Avoid using the
user parameter in the affected form until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾