PT-2017-13300 · Squiz · Squiz Matrix

Publicado 2017-11-30 · Atualizado 2019-10-03 · CVE-2017-14198

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Squiz Matrix versions prior to 5.3.6.1 Squiz Matrix versions 5.4.x prior to 5.4.1.3

Description An issue allows authenticated users with permissions to edit design assets to cause Remote Code Execution (RCE) via a maliciously crafted time format tag.

Recommendations For Squiz Matrix versions prior to 5.3.6.1, update to version 5.3.6.1 or later. For Squiz Matrix versions 5.4.x prior to 5.4.1.3, update to version 5.4.1.3 or later.

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-14198

Produtos afetados

Squiz Matrix

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-14198 · Aviso do Fabricante
• http://devalias.net/devalias/2017/09/07/squiz-matrix-multiple-vulnerabilities · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14198 · Nota de Segurança