En resumen
- CVE-2018-17567 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a jekyll, jekyll (jekyllrb).
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.2%, mayor que el 82.5% de las vulnerabilidades.
- Solución: actualizar a 3.7.4, 3.8.4, 3.6.3 o posterior.
| Package | Affected versions | Patched versions |
|---|
| jekyll RubyGems | ≥ 3.7.0, < 3.7.4≥ 3.8.0, < 3.8.4< 3.6.3
| 3.7.43.8.43.6.3
|
| jekyll | ≥ 3.7.0, ≤ 3.7.3≥ 3.8.0, ≤ 3.8.3≤ 3.6.2
| No fix yet |
Description
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the include key in the _config.yml file.
NVD description
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free