CVE-2011-4962

描述

`code/sitefeatures/PageCommentInterface.php` in SilverStripe 2.4.x before 2.4.6 might allow remote attackers to execute arbitrary code via a crafted cookie in a user comment submission, which is not properly handled when it is deserialized.

如何修補 CVE-2011-4962

要修補 CVE-2011-4962,請將受影響套件升級到下列已修補版本。

• Packagist/silverstripe/cms—升級至 2.4.6 或更新版本

CVE-2011-4962 正在被利用嗎?

低 — EPSS 為 3.9%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 2.4.0, < 2.4.6

參考連結(6)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2011-4962
• PATCHgithub.com/silverstripe/silverstripe-cms
• WEBwww.openwall.com/lists/oss-security/2012/04/30/1
• WEBwww.openwall.com/lists/oss-security/2012/04/30/3