PT-2017-14254
CVE-2017-15875
·
تاريخ النشر
2017-12-18
·
تاريخ التحديث
2018-01-02
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
GPWeb version 8.4.61
Description
A SQL injection issue in the Password Recovery feature allows remote attackers to execute arbitrary SQL commands by manipulating the
checkemail parameter.Recommendations
For GPWeb version 8.4.61, consider restricting access to the Password Recovery feature until a patch is available. As a temporary workaround, avoid using the
checkemail parameter in the affected API endpoint until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾