PT-2018-13599
CVE-2018-16477
·
تاريخ النشر
2018-11-30
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Active Storage versions 5.2.0 through 5.2.1.0
Description
A bypass issue in Active Storage for Google Cloud Storage and Disk services allows an attacker to modify the
content-disposition and content-type parameters, potentially executing HTML files inline. This can be combined with techniques like cookie bombing and specially crafted AppCache manifests to access private signed URLs within a specific storage path. Vulnerable applications are those using either GCS or the Disk service in production.Recommendations
For Active Storage versions 5.2.0 through 5.2.1.0, update to version 5.2.1.1 to resolve the issue.
As a temporary workaround, consider restricting access to the
content-disposition and content-type parameters until a patch is available.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾