CVE-2017-20179
InSTEDD Pollit tour_controller.rb TourController Privilege Escalation
Published 3 y ago · modified 4 mo ago · JSON
Summary
A vulnerability was found in InSTEDD Pollit 2.3.1. It has been rated as critical. This issue affects the function TourController of the file app/controllers/tour_controller.rb. The manipulation leads to an unknown weakness. The attack may be initiated remotely. Upgrading to version 2.3.2 is able to address this issue. The patch is named 6ef04f8b5972d5f16f8b86f8b53f62fac68d5498. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221507.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.74% probability of exploitation in the next 30 days, higher than 55% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- InSTEDD Pollit
References
- vuldb.com /?id.221507 · vdb-entry, technical-description, x_transferred
- vuldb.com /?ctiid.221507 · signature, permissions-required, x_transferred
- github.com /instedd/pollit/commit/6ef04f8b5972d5f16f8b86f8b53f62fac68d5498 · patch, x_transferred
- github.com /instedd/pollit/releases/tag/2.3.2 · patch, x_transferred
Sources
- CVE List: CVE-2017-20179
- NVD: CVE-2017-20179
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.