PT-2017-10910 · Elixir · Alchemist.Vim

Ivan · Publicado 2017-11-17 · Atualizado 2022-05-13 · CVE-2017-1000212

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions alchemist.vim (affected versions not specified)

Description The issue concerns remote code execution in the alchemist-server bundled with Elixir's vim plugin, alchemist.vim. A malicious website can execute requests against an ephemeral port on localhost, which are then evaluated as Elixir code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2017-1000212

GHSA-6X65-VQP7-5R63

Produtos afetados

Alchemist.Vim

Referências · 6

• https://github.com/tonini/alchemist-server/issues/14 · Nota
• https://github.com/tonini/alchemist-server · Nota
• https://github.com/tonini/alchemist-server/pull/16 · Nota
• https://osv.dev/vulnerability/GHSA-6x65-vqp7-5r63 · Aviso do Fabricante
• https://elixirforum.com/t/static-and-session-security-fixes-for-plug/3913 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000212 · Nota de Segurança