PT-2017-10698 · Ellislab · Expressionengine

Published 2017-06-22 · Updated 2019-10-09 · CVE-2017-0897

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ExpressionEngine versions 2.x through 2.11.7 ExpressionEngine versions 3.x through 3.5.4

Description The issue allows for the creation of an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.

Recommendations For ExpressionEngine versions 2.x through 2.11.7, update to version 2.11.8 or later. For ExpressionEngine versions 3.x through 3.5.4, update to version 3.5.5 or later.

Fix

RCE

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

CWE-331

Related Identifiers

CVE-2017-0897

Affected Products

Expressionengine

References · 8

• https://docs.expressionengine.com/v2/about/changelog.html#version-2-11-8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0897 · Vendor Advisory
• https://expressionengine.com/blog/expressionengine-3.5.5-and-2.11.8-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0897 · Security Note
• https://docs.expressionengine.com/latest/about/changelog.html#version-3-5-5 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0897 · Note
• https://hackerone.com/reports/215890 · Note
• http://securityfocus.com/bid/99242 · Note