PT-2019-11508
CVE-2019-1010201
·
تاريخ النشر
2019-07-23
·
تاريخ التحديث
2019-07-24
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions:
Jeesite versions prior to 4.0
Description:
The issue affects the
updateProcInsIdByBusinessId() function in src/main/java/com/thinkgem/jeesite/modules/act/ActDao.java, allowing for SQL Injection. This can lead to sensitive information disclosure. The attack vector involves network connectivity and requires authentication.Recommendations:
For versions prior to 4.0, update to version 4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the
updateProcInsIdByBusinessId() function until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾