PT-2023-10630 · Instedd · Instedd Pollit

Published 2023-02-21 · Updated 2024-05-17 · CVE-2017-20179

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions InSTEDD Pollit version 2.3.1

Description A critical issue affects the TourController function of the file app/controllers/tour controller.rb. The manipulation leads to an unknown weakness, and the attack may be initiated remotely. Upgrading to version 2.3.2 addresses this issue.

Recommendations For InSTEDD Pollit version 2.3.1, upgrade to version 2.3.2 to address the issue. As a temporary workaround, consider disabling the TourController function until the patch is applied.

Fix

Related Identifiers

CVE-2017-20179

Affected Products

Instedd Pollit

References · 7

• https://github.com/instedd/pollit/releases/tag/2.3.2 · Patch
• https://github.com/instedd/pollit/commit/6ef04f8b5972d5f16f8b86f8b53f62fac68d5498 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-20179 · Security Note
• https://osv.dev/vulnerability/CVE-2017-20179 · Vendor Advisory
• https://t.me/cibsecurity/58644 · Telegram Post
• https://vuldb.com/?id.221507 · Note
• https://vuldb.com/?ctiid.221507 · Note