CVE-2019-9580

概要

参考情報

• StackStorm/st2 release v2.10.3 · Release Notes
• StackStorm/st2 release v2.9.3 · Release Notes
• stackstorm.com/2019/03/08/stackstorm-2-9-3-2-10-3 · Vendor Advisory

stackstorm のその他の脆弱性

• CVE-2022-44009高 7.5Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to a…
• CVE-2022-43706中 5.4Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pa…
• CVE-2021-44657高 8.8In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands…
• CVE-2021-28667高 7.5StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Pytho…
• CVE-2018-20345中 5.3Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackS…