PT-2023-10629 · Codiad · Codiad

Cbaker · Publicado 2023-02-21 · Atualizado 2024-08-05 · CVE-2017-20178

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Codiad version 2.8.0

Description A vulnerability was found in the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.

Recommendations For Codiad version 2.8.0, upgrade to version 2.8.1 to address this issue. As a temporary workaround, consider restricting access to the saveJSON function in the components/install/process.php file until the upgrade is applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-20178

GHSA-2Q79-56RQ-8V3C

Produtos afetados

Codiad

Referências · 11

• https://github.com/Codiad/Codiad/releases/tag/v.2.8.1 · Correção
• https://github.com/Codiad/Codiad/commit/517119de673e62547ee472a730be0604f44342b5 · Correção
• https://github.com/Codiad/Codiad/pull/974 · Correção
• https://github.com/Codiad/Codiad · Nota
• https://vuldb.com/?id.221498 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-20178 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-2q79-56rq-8v3c · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-20178 · Aviso do Fabricante
• https://t.me/cvenotify/89304 · Publicação no Telegram
• https://t.me/cibsecurity/58634 · Publicação no Telegram
• https://vuldb.com/?ctiid.221498 · Nota