CVE-2017-2097

Опубликовано: 28 апр. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

Cross-site request forgery (CSRF) vulnerability in Knowledge versions prior to v1.7.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Ссылки

http://jvn.jp/en/jp/JVN09460804/index.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/95779
Third Party Advisory
VDB Entry
http://jvn.jp/en/jp/JVN09460804/index.html
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/95779
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:support-project:knowledge:*:*:*:*:*:*:*:*

Версия до 1.4.1 (включая)

cpe:2.3:a:support-project:knowledge:1.5.0:-:*:*:*:*:*:*

cpe:2.3:a:support-project:knowledge:1.5.0:pre1:*:*:*:*:*:*

cpe:2.3:a:support-project:knowledge:1.6.0:-:*:*:*:*:*:*

cpe:2.3:a:support-project:knowledge:1.6.0:pre1:*:*:*:*:*:*

cpe:2.3:a:support-project:knowledge:1.6.0:pre2:*:*:*:*:*:*

cpe:2.3:a:support-project:knowledge:1.6.0:pre3:*:*:*:*:*:*

cpe:2.3:a:support-project:knowledge:1.6.0:pre4:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.0011

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-j597-mqj3-79c6