CVE-2017-1000052 Null Byte Injection in Plug.Static
HighCVSS 7.8
EPSS 0.42%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hex plug(Hex) | < 1.0.4 | 1.0.4 |
| hex plug(Hex) | >= 1.1.0, < 1.1.7 | 1.1.7 |
| hex plug(Hex) | >= 1.2.0, < 1.2.3 | 1.2.3 |
| hex plug(Hex) | >= 1.3.0, < 1.3.2 | 1.3.2 |
| plug project plug | >= 1.0.0, < 1.0.4 | 1.0.4 |
| plug project plug | >= 1.1.0, < 1.1.7 | 1.1.7 |
| plug project plug | >= 1.2.0, < 1.2.3 | 1.2.3 |
| plug project plug | >= 1.3.0, < 1.3.2 | 1.3.2 |
References
- nvd.nist.gov third-party-advisory
- elixirforum.com third-party-advisory
- github.com