PT-2021-23239
CVE-2021-41280
·
تاريخ النشر
2021-11-19
·
تاريخ التحديث
2021-11-24
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Sharetribe Go versions prior to 10.2.1
Description
The issue affects Sharetribe Go, a source available marketplace software, where operating system command injection is possible on installations without a secret AWS Simple Notification Service (SNS) notification token configured via the
sns notification token configuration parameter. This parameter is unset by default.Recommendations
For versions prior to 10.2.1, upgrade to version 10.2.1 to resolve the issue.
As a temporary workaround for users who are unable to upgrade, set the
sns notification token configuration parameter to a secret value. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾