PT-2022-7904 · Phplist · Phplist

Tim Coen · Published 2022-06-10 · Updated 2022-06-17 · CVE-2017-20031

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPList versions 3.2.6

Description A vulnerability in PHPList allows for information disclosure through the manipulation of the sortby argument with the input password. This can be exploited remotely. The issue affects an unknown functionality of the software.

Recommendations For PHPList version 3.2.6, upgrade to version 3.3.1 to address the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-20031

Affected Products

Phplist

References · 5

• 🔥 http://seclists.org/fulldisclosure/2017/Mar/45 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-20031 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20031 · Vendor Advisory
• https://t.me/cibsecurity/44163 · Telegram Post
• https://vuldb.com/?id.98917 · Note