CVE-2017-1000053 Arbitrary Code Execution in Cookie Serialization
HighCVSS 8.1
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hex plug(Hex) | < 1.0.4 | 1.0.4 |
| hex plug(Hex) | >= 1.1.0, < 1.1.7 | 1.1.7 |
| hex plug(Hex) | >= 1.2.0, < 1.2.3 | 1.2.3 |
| hex plug(Hex) | >= 1.3.0, < 1.3.2 | 1.3.2 |
| plug project plug | >= 1.0.0, < 1.0.4 | 1.0.4 |
| plug project plug | >= 1.1.0, < 1.1.7 | 1.1.7 |
| plug project plug | >= 1.2.0, < 1.2.3 | 1.2.3 |
| plug project plug | >= 1.3.0, < 1.3.2 | 1.3.2 |
References
- nvd.nist.gov third-party-advisory
- elixirforum.com mitigation third-party-advisory
- github.com