PT-2017-6442
CVE-2015-0249
·
تاريخ النشر
2017-07-14
·
تاريخ التحديث
2017-07-27
الوصف من
CVSS 2.0
6.5
متوسطةالمقاييسAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions
Apache Roller versions 5.1 through 5.1.1
Description
The issue allows remote authenticated users with admin privileges for a weblog to execute arbitrary Java code via crafted Velocity Text Language (VTL) in the weblog page template.
Recommendations
For Apache Roller versions 5.1 through 5.1.1, consider restricting access to the weblog page template to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the use of Velocity Text Language (VTL) in the weblog page template to prevent the execution of arbitrary Java code.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾