Описание
In Fat-Free Framework 3.7.1, attackers can achieve arbitrary code execution if developers choose to pass user controlled input (e.g., $_REQUEST, $_GET, or $_POST) to the framework's Clear method.
Ссылки
- PatchThird Party Advisory
- Release NotesThird Party Advisory
- PatchThird Party Advisory
- Release NotesThird Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:fatfreeframework:fat-free_framework:3.7.1:*:*:*:*:*:*:*
EPSS
Процентиль: 70%
0.00646
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-20
Связанные уязвимости
EPSS
Процентиль: 70%
0.00646
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-20