CVE-2017-1000423: Input Validation
b2evolution version 6.6.0 - 6.8.10 is vulnerable to input validation (backslash and single quote escape) in basic install functionality resulting in unauthenticated attacker gaining PHP code execution on the victim's setup.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000423?
CVE-2017-1000423 has been rated as a high severity vulnerability due to the potential for unauthenticated PHP code execution.
How do I fix CVE-2017-1000423?
To fix CVE-2017-1000423, upgrade b2evolution to version 6.8.11 or later where the vulnerability has been patched.
What versions of b2evolution are affected by CVE-2017-1000423?
CVE-2017-1000423 affects b2evolution versions 6.6.0 through 6.8.10.
What type of security issue is CVE-2017-1000423 categorized as?
CVE-2017-1000423 is categorized as an input validation vulnerability, which leads to remote code execution.
Can an attacker exploit CVE-2017-1000423 without authentication?
Yes, an attacker can exploit CVE-2017-1000423 without authentication, gaining unauthorized access to execute PHP code.