PT-2023-10629 · Codiad · Codiad

Cbaker · Published 2023-02-21 · Updated 2024-08-05 · CVE-2017-20178

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Codiad version 2.8.0

Description A vulnerability was found in the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult.

Recommendations For Codiad version 2.8.0, upgrade to version 2.8.1 to address this issue. As a temporary workaround, consider restricting access to the saveJSON function in the components/install/process.php file until the upgrade is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-20178

GHSA-2Q79-56RQ-8V3C

Affected Products

Codiad

References · 11

• https://github.com/Codiad/Codiad/releases/tag/v.2.8.1 · Patch
• https://github.com/Codiad/Codiad/commit/517119de673e62547ee472a730be0604f44342b5 · Patch
• https://github.com/Codiad/Codiad/pull/974 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-20178 · Security Note
• https://osv.dev/vulnerability/GHSA-2q79-56rq-8v3c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-20178 · Vendor Advisory
• https://github.com/Codiad/Codiad · Note
• https://vuldb.com/?id.221498 · Note
• https://t.me/cvenotify/89304 · Telegram Post
• https://t.me/cibsecurity/58634 · Telegram Post
• https://vuldb.com/?ctiid.221498 · Note