PT-2017-10719 · Chyrp · Chyrp Lite

Fleetcaptain · Publicado 2017-07-13 · Atualizado 2017-08-07 · CVE-2017-1000008

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chyrp Lite version 2016.04

Description The issue allows attackers to hijack the authentication of logged-in users, enabling them to modify account information, including passwords, through a CSRF in the user settings function.

Recommendations For Chyrp Lite version 2016.04, consider disabling the user settings function temporarily to prevent exploitation until a fix is available. Restrict access to the user settings module to minimize the risk of account information modification. Avoid using the vulnerable function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-1000008

Produtos afetados

Chyrp Lite

Referências · 3

• https://github.com/xenocrat/chyrp-lite/commit/79bb2de7f57d163d256b6bdb127dc09cfdb6235a · Nota
• https://osv.dev/vulnerability/CVE-2017-1000008 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000008 · Nota de Segurança