CVE-2017-11667

Опубликовано: 26 июл. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.

Ссылки

https://github.com/opf/openproject/commit/0fdd7578909d2ec50abc275fc4962e99566437ee
Patch
https://www.openproject.org/openproject-6-1-6-released-security-fix/
Vendor Advisory
https://www.openproject.org/openproject-7-0-3-released/
Vendor Advisory
https://github.com/opf/openproject/commit/0fdd7578909d2ec50abc275fc4962e99566437ee
Patch
https://www.openproject.org/openproject-6-1-6-released-security-fix/
Vendor Advisory
https://www.openproject.org/openproject-7-0-3-released/
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openproject:openproject:*:*:*:*:*:*:*:*

Версия до 6.1.5 (включая)

cpe:2.3:a:openproject:openproject:7.0.0:*:*:*:*:*:*:*

cpe:2.3:a:openproject:openproject:7.0.1:*:*:*:*:*:*:*

cpe:2.3:a:openproject:openproject:7.0.2:*:*:*:*:*:*:*

EPSS

Процентиль: 74%

0.00817

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-613

Связанные уязвимости

GHSA-2w7h-66vj-246p