CVE-2014-5297

ALTO 7.5CVE-2014-5297 · Published 10/10/2014 · updated 17/06/2026

En resumen

CVE-2014-5297 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a x2engine (x2engine).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.7%, mayor que el 85.8% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
x2engine x2engine	`= 2.8= 4.1.7`	No fix yet

Description

The actionSendErrorReport method in protected/controllers/SiteController.php in X2Engine 2.8 through 4.1.7 allows remote attackers to conduct PHP object injection and Server-Side Request Forgery (SSRF) attacks via crafted serialized data in the report parameter.

References

karmainsecurity.com/KIS-2014-09 · Exploit
packetstormsecurity.com/files/128352/X2Engine-4.1.7-PHP-Object-Injection.html · Exploit
seclists.org/fulldisclosure/2014/Sep/77 · Exploit
securityfocus.com/archive/1/533513/100/0/threaded
x2community.com/topic/1804-important-security-patch · Patch

Más vulnerabilidades de x2engine

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free