7.5

CVE-2017-0897

ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Expressionengine ≫ Expressionengine Version2.0.0 Updatepublic_beta
Expressionengine ≫ Expressionengine Version2.0.1 Updatepublic_beta
Expressionengine ≫ Expressionengine Version2.0.2 Updatepublic_beta
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.04% 0.893
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

CWE-331 Insufficient Entropy

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

http://www.securityfocus.com/bid/99242
Third Party Advisory
VDB Entry
https://docs.expressionengine.com/latest/about/changelog.html#version-3-5-5
Vendor Advisory
https://docs.expressionengine.com/v2/about/changelog.html#version-2-11-8
Vendor Advisory
https://expressionengine.com/blog/expressionengine-3.5.5-and-2.11.8-released
Vendor Advisory
https://hackerone.com/reports/215890
Permissions Required