PT-2017-12765 · Vebto · Vebto Pixie Image Editor

Publicado 2017-09-25 · Atualizado 2020-10-02 · CVE-2017-12905

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vebto Pixie Image Editor versions 1.4 through 1.7

Description A Server Side Request Forgery issue allows remote attackers to disclose information or execute arbitrary code via the url parameter to "Launderer.php" API endpoint.

Recommendations For versions 1.4 through 1.7, avoid using the url parameter in the "Launderer.php" endpoint until the issue is resolved.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2017-12905

Produtos afetados

Vebto Pixie Image Editor

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-12905 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2017/Sep/47 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12905 · Nota de Segurança