PT-2017-16418
CVE-2017-5244
·
تاريخ النشر
2017-06-15
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 2.0
3.5
منخفضةالمقاييسAV:N/AC:M/Au:S/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions
Metasploit versions prior to 4.14.0 (Update 2017061301)
Description
A security issue allowed GET requests to stop running tasks, which should only be allowed via POST requests, as these actions change the service state. This could have enabled an attacker to stop running tasks by tricking an authenticated user into executing JavaScript.
Recommendations
For versions prior to 4.14.0 (Update 2017061301), update to Metasploit 4.14.0 (Update 2017061301) to ensure that only POST requests, which include a secret token to prevent CSRF attacks, are allowed to stop tasks.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾