| Package | Affected versions | Patched versions |
|---|---|---|
| expressionengine | = 2.0.0= 2.0.1= 2.0.2= 2.1.0= 2.1.1= 2.1.2= 2.1.3= 2.1.4= 2.1.5= 2.10.0= 2.10.1= 2.10.2= 2.10.3= 2.11.0= 2.11.1= 2.11.2= 2.11.3= 2.11.4= 2.11.5= 2.11.6= 2.11.7= 2.2.0= 2.2.1= 2.2.2= 2.3.0= 2.3.1= 2.4.0= 2.5.0= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 2.6.0= 2.6.1= 2.7.0= 2.7.1= 2.7.2= 2.7.3= 2.8.0= 2.8.1= 2.9.0= 2.9.1= 2.9.2= 2.9.3= 3.0.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5= 3.0.6= 3.1.0= 3.1.1= 3.1.2= 3.1.3= 3.1.4= 3.2.0= 3.2.1= 3.3.0= 3.3.1= 3.3.2= 3.3.3= 3.3.4= 3.4.0= 3.4.1= 3.4.2= 3.4.3= 3.4.4= 3.4.5= 3.4.6= 3.4.7= 3.5.0= 3.5.1= 3.5.2= 3.5.3= 3.5.4 |
ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free