PT-2018-5261 · Pepperminty · Pepperminty-Wiki

Prodigysml · Published 2018-01-03 · Updated 2020-10-19 · CVE-2017-1000497

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pepperminty-Wiki version 0.15

Description The issue concerns an XXE (XML External Entity) attack in the getsvgsize function, potentially leading to denial of service and possibly remote code execution.

Recommendations For Pepperminty-Wiki version 0.15, consider disabling the getsvgsize function as a temporary workaround until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-1000497

Affected Products

Pepperminty-Wiki

References · 3

• https://osv.dev/vulnerability/CVE-2017-1000497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000497 · Security Note
• https://github.com/sbrl/Pepperminty-Wiki/issues/152 · Note