CVE-2017-17762

Опубликовано: 29 авг. 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

XML external entity (XXE) vulnerability in Episerver 7 patch 4 and earlier allows remote attackers to read arbitrary files via a crafted DTD in an XML request involving util/xmlrpc/Handler.ashx.

Ссылки

https://gist.github.com/jonaslejon/5f92779848360a1a1e676af0795bd9aa
Exploit
Third Party Advisory
https://kryptera.se/sarbarhet-i-episerver/
Exploit
Mitigation
Third Party Advisory
https://gist.github.com/jonaslejon/5f92779848360a1a1e676af0795bd9aa
Exploit
Third Party Advisory
https://kryptera.se/sarbarhet-i-episerver/
Exploit
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:episerver:episerver:*:*:*:*:*:*:*:*

Версия до 7 (включая)

cpe:2.3:a:episerver:episerver:7:*:*:*:*:*:*:*

cpe:2.3:a:episerver:episerver:7:patch_1:*:*:*:*:*:*

cpe:2.3:a:episerver:episerver:7:patch_2:*:*:*:*:*:*

cpe:2.3:a:episerver:episerver:7:patch_3:*:*:*:*:*:*

cpe:2.3:a:episerver:episerver:7:patch_4:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.10472

Средний

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-611

Связанные уязвимости

GHSA-qvv4-58rx-f26c