PT-2018-5261 · Pepperminty · Pepperminty-Wiki

Prodigysml · Publicado 2018-01-03 · Atualizado 2020-10-19 · CVE-2017-1000497

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pepperminty-Wiki version 0.15

Description The issue concerns an XXE (XML External Entity) attack in the getsvgsize function, potentially leading to denial of service and possibly remote code execution.

Recommendations For Pepperminty-Wiki version 0.15, consider disabling the getsvgsize function as a temporary workaround until a patch is available.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-1000497

Produtos afetados

Pepperminty-Wiki

Referências · 3

• https://github.com/sbrl/Pepperminty-Wiki/issues/152 · Nota
• https://osv.dev/vulnerability/CVE-2017-1000497 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000497 · Nota de Segurança