PT-2017-8010
CVE-2016-2165
·
تاريخ النشر
2017-05-25
·
تاريخ التحديث
2021-08-25
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Pivotal Elastic Runtime versions prior to 1.5.19
Pivotal Elastic Runtime versions 1.6.x prior to 1.6.20
cf-release versions prior to v231
Description
The issue concerns the Loggregator Traffic Controller endpoints, which are not properly cleansing request URL paths when they are invalid. As a result, these invalid paths are returned in the 404 response, potentially allowing malicious scripts to be injected directly into the response.
Recommendations
For Pivotal Elastic Runtime versions prior to 1.5.19, update to version 1.5.19 or later.
For Pivotal Elastic Runtime versions 1.6.x prior to 1.6.20, update to version 1.6.20 or later.
For cf-release versions prior to v231, update to version v231 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾