PT-2019-12163
CVE-2019-11066
·
تاريخ النشر
2019-05-10
·
تاريخ التحديث
2019-05-13
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
LightOpenID versions through 1.3.1
Description
The issue allows for Server-Side Request Forgery (SSRF) via a crafted OpenID 2.0 assertion request using the HTTP GET method. This is related to the openid.php file in LightOpenID.
Recommendations
For versions through 1.3.1, consider restricting access to the openid.php file to minimize the risk of SSRF exploitation until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾