PT-2021-17781
CVE-2021-28157
·
تاريخ النشر
2021-04-14
·
تاريخ التحديث
2021-04-21
الوصف من
CVSS 3.1
7.2
عاليةالمقاييسAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
Devolutions Server versions prior to 2021.1
Devolutions Server LTS versions prior to 2020.3.18
Description:
The issue allows an administrative user to execute arbitrary SQL commands via a
username in the "api/security/userinfo/delete" endpoint.Recommendations:
For Devolutions Server versions prior to 2021.1, update to version 2021.1 or later.
For Devolutions Server LTS versions prior to 2020.3.18, update to version 2020.3.18 or later.
As a temporary workaround, consider restricting access to the "api/security/userinfo/delete" endpoint until a patch is available.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾