| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| getformwork/formwork | ≥ 2.0.0-beta.3, < 2.0.0-beta.4 | 2.0.0-beta.4 |
The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users.
The attack is widespread, leveraging what XSS can do. This will undoubtedly impact system availability.
By embedding "<!--", the source code can be rendered non-functional, significantly impacting system availability. However, the attacker would need admin privileges, making the attack more difficult to execute.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン