PT-2017-12121 · Dayrui · Finecms

Lorexxar · Publicado 2017-07-24 · Atualizado 2017-07-28 · CVE-2017-11586

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions dayrui FineCms version 5.0.9

Description The issue concerns URL Redirector Abuse via the url parameter in a sync action, related to the controllers/Weixin.php file.

Recommendations For dayrui FineCms version 5.0.9, consider restricting access to the url parameter in the sync action to minimize the risk of exploitation. Avoid using the url parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2017-11586

Produtos afetados

Finecms

Referências · 3

• 🔥 http://lorexxar.cn/2017/07/20/FineCMS%20multi%20vulnerablity%20before%20v5.0.9/#URL-Redirector-Abuse · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11586 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11586 · Aviso do Fabricante