PT-2021-11969
CVE-2020-36232
·
تاريخ النشر
2021-02-22
·
تاريخ التحديث
2022-03-30
الوصف من
CVSS 3.1
5.0
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions:
atlassian-gadgets versions 4.2.37 and earlier
atlassian-gadgets versions 4.3.0 through 4.3.13
atlassian-gadgets versions 4.3.2.0 through 4.3.2.3
atlassian-gadgets versions 4.4.0 through 4.4.11
atlassian-gadgets versions 5.0.0
Description:
The MessageBundleWhiteList class of atlassian-gadgets incorrectly obtained application base URL information from the executing HTTP request, which could be controlled by an attacker, allowing unexpected DNS lookups and requests to arbitrary services.
Recommendations:
For atlassian-gadgets versions 4.2.37 and earlier, update to version 4.2.37 or later.
For atlassian-gadgets versions 4.3.0 through 4.3.13, update to version 4.3.14 or later.
For atlassian-gadgets versions 4.3.2.0 through 4.3.2.3, update to version 4.3.2.4 or later.
For atlassian-gadgets versions 4.4.0 through 4.4.11, update to version 4.4.12 or later.
For atlassian-gadgets versions 5.0.0, update to version 5.0.1 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾