PT-2018-8347 · Kaazing · Kaazing Gateway Enterprise Edition+3

Publicado

2018-04-12

·

Atualizado

2021-04-19

·

CVE-2017-6910

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Kaazing Gateway versions prior to 4.5.3 hotfix-1 Kaazing Gateway - JMS Edition versions prior to 4.0.5 hotfix-15 Kaazing Gateway - JMS Edition version 4.0.6 prior to hotfix-4 Kaazing Gateway - JMS Edition version 4.0.7 Kaazing Gateway - JMS Edition versions 4.0.9 prior to hotfix-19 Kaazing Gateway versions 4.4.x prior to 4.4.2 hotfix-1 Kaazing Gateway versions 4.5.x prior to 4.5.3 hotfix-1 Kaazing Gateway Community and Enterprise Editions versions prior to 5.6.0
Description The issue allows remote attackers to bypass intended access restrictions and obtain sensitive information via vectors related to HTTP request handling. This is related to the HTTP and WebSocket engine components in the server.
Recommendations For Kaazing Gateway versions prior to 4.5.3 hotfix-1, update to version 4.5.3 hotfix-1 or later. For Kaazing Gateway - JMS Edition versions prior to 4.0.5 hotfix-15, update to version 4.0.5 hotfix-15 or later. For Kaazing Gateway - JMS Edition version 4.0.6, apply hotfix-4 or later. For Kaazing Gateway - JMS Edition version 4.0.7, update to a later version. For Kaazing Gateway - JMS Edition versions 4.0.9 prior to hotfix-19, apply hotfix-19 or later. For Kaazing Gateway versions 4.4.x prior to 4.4.2 hotfix-1, update to version 4.4.2 hotfix-1 or later. For Kaazing Gateway versions 4.5.x prior to 4.5.3 hotfix-1, update to version 4.5.3 hotfix-1 or later. For Kaazing Gateway Community and Enterprise Editions versions prior to 5.6.0, update to version 5.6.0 or later.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-6910

Produtos afetados

Kaazing Gateway
Kaazing Gateway - Jms Edition
Kaazing Gateway Community Edition
Kaazing Gateway Enterprise Edition