PT-2017-18694 · Allen · Allen Disk

Ghost · Publicado 2017-05-19 · Atualizado 2020-03-02 · CVE-2017-9090

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Allen Disk version 1.6

Description The issue allows bypassing the CAPTCHA protection by submitting an empty captcha value in the POST request. This is due to the lack of proper validation of the $ SESSION['captcha']['code'] variable in the reg.php file.

Recommendations For Allen Disk version 1.6, consider adding a check to ensure that the $ SESSION['captcha']['code'] is properly set and validated before allowing registration. As a temporary workaround, consider implementing additional validation for the $ POST['captcha'] variable to prevent empty submissions.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-9090

Produtos afetados

Allen Disk

Referências · 3

• https://github.com/s3131212/allendisk/issues/25 · Correção
• https://osv.dev/vulnerability/CVE-2017-9090 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9090 · Nota de Segurança