Ariadne Component Library vulnerable to Server-Side Request Forgery

緊急 9.8CVE-2017-20157 · GHSA-qr97-v87p-x965 · 31/12/2022 公開 · 17/06/2026 更新

要点

CVE-2017-20157 は arc/web, ariadne component library (ariadne-cms) に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.73%（全脆弱性の 54.3% より高い）。
対処：3.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
arc/web Packagist	`< 3.0`	`3.0`
ariadne component library ariadne-cms	`< 3.0`	`3.0`

概要

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 can address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.

NVD の説明

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.

参考情報

nvd.nist.gov/vuln/detail/CVE-2017-20157 · ADVISORY
Ariadne-CMS/arc-web commit 1feb1cc · WEB
Ariadne-CMS/arc-web · PACKAGE
Ariadne-CMS/arc-web release 3.0 · WEB
vuldb.com · WEB
vuldb.com · WEB

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

arc/web

Packagist

< 3.0

3.0

ariadne component library

ariadne-cms

< 3.0

3.0

概要

NVD の説明

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.