PT-2020-12940
CVE-2020-11944
·
تاريخ النشر
2020-04-20
·
تاريخ التحديث
2020-05-05
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Abe (aka bitcoin-abe) versions 0.7.2 and earlier, 0.8pre
Description
The issue allows for XSS in the
call function within abe.py. This occurs because the PATH INFO environment variable is mishandled during a PageNotFound exception.Recommendations
For versions 0.7.2 and earlier, and 0.8pre, consider restricting access to the
call function in abe.py until a proper fix is applied.
As a temporary workaround, avoid using the PATH INFO environment variable in the affected PageNotFound exception handling until the issue is resolved. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾