CVE-2017-6910 The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hotfix-4, 4.0.7, 4.0.9 before hotfix-19, 4.4...
HighCVSS 7.5
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hotfix-4, 4.0.7, 4.0.9 before hotfix-19, 4.4.x before 4.4.2 hotfix-1, 4.5.x before 4.5.3 hotfix-1, and Gateway Community and Enterprise Editions before 5.6.0 allow remote attackers to bypass intended access restrictions and obtain sensitive information via vectors related to HTTP request handling.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kaazing gateway | < 4.5.3 | 4.5.3 |
| kaazing gateway | = 4.5.3 | No fix listed |
| kaazing gateway | = 4.5.3-hotfix1 | No fix listed |
| kaazing gateway | >= 4.4.0, < 4.4.2 | 4.4.2 |
| kaazing gateway | >= 4.5.0, < 4.5.3 | 4.5.3 |
| kaazing gateway | = 4.0.5 | No fix listed |
| kaazing gateway | = 4.0.6 | No fix listed |
| kaazing gateway | = 4.0.6-hotfix2 | No fix listed |
| kaazing gateway | = 4.0.7 | No fix listed |
| kaazing gateway | = 4.4.2-hotfix1 | No fix listed |
| tenefit kaazing websocket gateway | < 5.6.0 | 5.6.0 |
References
- support.kaazing.com mitigation vendor-advisory