PT-2017-18307 · Pixel & Tonic · Craft Cms

Publicado 2017-05-01 · Atualizado 2022-05-17 · CVE-2017-8384

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 2.6.2976

Description The issue allows for XSS attacks due to an array returned by HttpRequestService::getSegments() and getActionSegments() not being zero-based, resulting from an incomplete fix for a previous security issue.

Recommendations For versions prior to 2.6.2976, update to version 2.6.2976 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8384

GHSA-9MCW-MWXV-GRWJ

Produtos afetados

Craft Cms

Referências · 6

• https://github.com/craftcms/cms · Nota
• https://osv.dev/vulnerability/GHSA-9mcw-mwxv-grwj · Aviso do Fabricante
• https://twitter.com/CraftCMS/status/857743080224473088 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8384 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8384 · Aviso do Fabricante
• https://craftcms.com/changelog#2-6-2976 · Aviso do Fabricante