CVE-2017-20157 Ariadne Component Library Url.php server-side request forgery
CriticalCVSS 9.8
EPSS 0.73%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arc/web(Packagist) | < 3.0 | 3.0 |
| arc/web(Packagist) | = 1.0 | No fix listed |
| arc/web(Packagist) | = 1.0.1 | No fix listed |
| arc/web(Packagist) | = 1.0.2 | No fix listed |
| arc/web(Packagist) | = 1.1 | No fix listed |
| arc/web(Packagist) | = 2.0 | No fix listed |
| arc/web(Packagist) | = 2.1 | No fix listed |
| ariadne-cms ariadne component library | < 3.0 | 3.0 |
| ariadne Component Library | = 2.x | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com product
- github.com patch release-notes third-party-advisory
- vuldb.com permissions-required signature third-party-advisory
- vuldb.com technical-description third-party-advisory vdb-entry
- github.com