Ariadne Component Library vulnerable to Server-Side Request Forgery

NGHIÊM TRỌNG 9.8CVE-2017-20157 · GHSA-qr97-v87p-x965 · Công bố 31/12/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2017-20157 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng arc/web, ariadne component library (ariadne-cms).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.73%, cao hơn 54.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
arc/web Packagist	`< 3.0`	`3.0`
ariadne component library ariadne-cms	`< 3.0`	`3.0`

Mô tả

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 can address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.

Mô tả của NVD

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2017-20157 · ADVISORY
Ariadne-CMS/arc-web commit 1feb1cc · WEB
Ariadne-CMS/arc-web · PACKAGE
Ariadne-CMS/arc-web release 3.0 · WEB
vuldb.com · WEB
vuldb.com · WEB

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí

Gói / sản phẩm

Phiên bản bị ảnh hưởng

Phiên bản đã vá

arc/web

Packagist

< 3.0

3.0

ariadne component library

ariadne-cms

< 3.0

3.0

Mô tả

Mô tả của NVD

A vulnerability was found in Ariadne Component Library up to 2.x. It has been classified as critical. Affected is an unknown function of the file src/url/Url.php. The manipulation leads to server-side request forgery. Upgrading to version 3.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217140.