PT-2017-13300 · Squiz · Squiz Matrix

Published 2017-11-30 · Updated 2019-10-03 · CVE-2017-14198

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Squiz Matrix versions prior to 5.3.6.1 Squiz Matrix versions 5.4.x prior to 5.4.1.3

Description An issue allows authenticated users with permissions to edit design assets to cause Remote Code Execution (RCE) via a maliciously crafted time format tag.

Recommendations For Squiz Matrix versions prior to 5.3.6.1, update to version 5.3.6.1 or later. For Squiz Matrix versions 5.4.x prior to 5.4.1.3, update to version 5.4.1.3 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2017-14198

Affected Products

Squiz Matrix

References · 3

• https://osv.dev/vulnerability/CVE-2017-14198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14198 · Security Note
• http://devalias.net/devalias/2017/09/07/squiz-matrix-multiple-vulnerabilities · Note