// For flags

CVE-2017-20174

bastianallgeier Kirby Webmentions Plugin injection

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to injection. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The patch is identified as 55bedea78ae9af916a9a41497bd9996417851502. It is recommended to apply a patch to fix this issue. VDB-218894 is the identifier assigned to this vulnerability.

Se encontró una vulnerabilidad en bastianallgeier Kirby Webmentions de Github y fue clasificada como problemática. Una función desconocida es afectada por este problema. La manipulación conduce a la inyección. El ataque puede lanzarse de forma remota. La complejidad de un ataque es bastante alta. Se sabe que la explotación es difícil. El parche se identifica como 55bedea78ae9af916a9a41497bd9996417851502. Se recomienda aplicar un parche para solucionar este problema. VDB-218894 es el identificador asignado a esta vulnerabilidad.

Eine Schwachstelle wurde in bastianallgeier Kirby Webmentions Plugin gefunden. Sie wurde als problematisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion. Mittels dem Manipulieren mit unbekannten Daten kann eine injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Die Komplexität eines Angriffs ist eher hoch. Sie ist schwierig ausnutzbar. Der Patch wird als 55bedea78ae9af916a9a41497bd9996417851502 bezeichnet. Als bestmögliche Massnahme wird Patching empfohlen.

*Credits: VulDB GitHub Commit Analyzer
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-01-18 CVE Reserved
  • 2023-01-19 CVE Published
  • 2024-08-05 CVE Updated
  • 2024-09-09 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Getkirby
Search vendor "Getkirby"
 Webmentions
Search vendor "Getkirby" for product "Webmentions"
 < 2017-02-01
Search vendor "Getkirby" for product "Webmentions" and version " < 2017-02-01"
kirby
Affected