CVE-2017-20164mediumCWE-601

CVE-2017-20164: falha de média gravidade em Symbiote Seed

Symbiote Seed Login SecurityLoginExtension.php onBeforeSecurityLogin redirect

Publicada em 07 jan 2023 · Atualizada em 08 abr 2025

Seguir esta CVE + Monitorar Seed + Monitorar symbiote/silverstripe-seed

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.6%

A vulnerability was found in Symbiote Seed up to 6.0.2. It has been classified as critical. Affected is the function onBeforeSecurityLogin of the file code/extensions/SecurityLoginExtension.php of the component Login. The manipulation of the argument URL leads to open redirect. It is possible to launch the attack remotely. Upgrading to version 6.0.3 is able to address this issue. The patch is identified as b065ebd82da53009d273aa7e989191f701485244. It is recommended to upgrade the affected component. VDB-217626 is the identifier assigned to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Produtos afetados

Symbiote · Seed

Referências

https://github.com/symbiote/silverstripe-seed/commit/b065ebd82da53009d273aa7e989191f701485244 https://github.com/symbiote/silverstripe-seed/releases/tag/6.0.3 https://vuldb.com/?ctiid.217626 https://vuldb.com/?id.217626