Vulnerability Database

296,676

Total vulnerabilities in the database

CVE-2017-0897

ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.

  • Published: Jun 22, 2017
  • Updated: Apr 13, 2023
  • CVE: CVE-2017-0897
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
expressionengine / expressionengine 2.2.1 2.2.1.x
expressionengine / expressionengine 3.4.7 3.4.7.x
expressionengine / expressionengine 3.5.4 3.5.4.x
expressionengine / expressionengine 2.8.1 2.8.1.x
expressionengine / expressionengine 2.9.1 2.9.1.x
expressionengine / expressionengine 3.3.1 3.3.1.x
expressionengine / expressionengine 3.3.2 3.3.2.x
expressionengine / expressionengine 2.10.3 2.10.3.x
expressionengine / expressionengine 2.10.1 2.10.1.x
expressionengine / expressionengine 3.0.2 3.0.2.x
expressionengine / expressionengine 3.4.2 3.4.2.x
expressionengine / expressionengine 2.11.0 2.11.0.x
expressionengine / expressionengine 2.6.1 2.6.1.x
expressionengine / expressionengine 2.10.0 2.10.0.x
expressionengine / expressionengine 3.5.0 3.5.0.x
expressionengine / expressionengine 2.1.4 2.1.4.x
expressionengine / expressionengine 2.5.3 2.5.3.x
expressionengine / expressionengine 3.2.1 3.2.1.x
expressionengine / expressionengine 3.0.6 3.0.6.x
expressionengine / expressionengine 2.2.2 2.2.2.x
expressionengine / expressionengine 2.9.3 2.9.3.x
expressionengine / expressionengine 2.1.5 2.1.5.x
expressionengine / expressionengine 2.5.5 2.5.5.x
expressionengine / expressionengine 2.5.2 2.5.2.x
expressionengine / expressionengine 2.7.2 2.7.2.x
expressionengine / expressionengine 2.3.0 2.3.0.x
expressionengine / expressionengine 2.1.1 2.1.1.x
expressionengine / expressionengine 2.8.0 2.8.0.x
expressionengine / expressionengine 3.2.0 3.2.0.x
expressionengine / expressionengine 2.3.1 2.3.1.x
expressionengine / expressionengine 3.3.4 3.3.4.x
expressionengine / expressionengine 2.9.0 2.9.0.x
expressionengine / expressionengine 2.0.2-public_beta 2.0.2-public_beta.x
expressionengine / expressionengine 2.7.1 2.7.1.x
expressionengine / expressionengine 3.1.2 3.1.2.x
expressionengine / expressionengine 2.2.0 2.2.0.x
expressionengine / expressionengine 2.11.3 2.11.3.x
expressionengine / expressionengine 2.11.4 2.11.4.x
expressionengine / expressionengine 3.4.4 3.4.4.x
expressionengine / expressionengine 2.4.0 2.4.0.x
expressionengine / expressionengine 3.1.0 3.1.0.x
expressionengine / expressionengine 3.0.4 3.0.4.x
expressionengine / expressionengine 3.4.5 3.4.5.x
expressionengine / expressionengine 2.0.1-public_beta 2.0.1-public_beta.x
expressionengine / expressionengine 2.5.4 2.5.4.x
expressionengine / expressionengine 3.0.3 3.0.3.x
expressionengine / expressionengine 3.4.0 3.4.0.x
expressionengine / expressionengine 3.0.0 3.0.0.x
expressionengine / expressionengine 2.11.7 2.11.7.x
expressionengine / expressionengine 3.5.3 3.5.3.x
expressionengine / expressionengine 2.0.0-public_beta 2.0.0-public_beta.x
expressionengine / expressionengine 3.0.1 3.0.1.x
expressionengine / expressionengine 2.11.5 2.11.5.x
expressionengine / expressionengine 2.1.2 2.1.2.x
expressionengine / expressionengine 2.11.2 2.11.2.x
expressionengine / expressionengine 2.5.1 2.5.1.x
expressionengine / expressionengine 2.11.6 2.11.6.x
expressionengine / expressionengine 3.0.5 3.0.5.x
expressionengine / expressionengine 2.7.0 2.7.0.x
expressionengine / expressionengine 3.4.3 3.4.3.x
expressionengine / expressionengine 3.4.6 3.4.6.x
expressionengine / expressionengine 3.1.1 3.1.1.x
expressionengine / expressionengine 3.5.2 3.5.2.x
expressionengine / expressionengine 3.4.1 3.4.1.x
expressionengine / expressionengine 3.3.3 3.3.3.x
expressionengine / expressionengine 2.11.1 2.11.1.x
expressionengine / expressionengine 2.9.2 2.9.2.x
expressionengine / expressionengine 3.1.3 3.1.3.x
expressionengine / expressionengine 2.1.0 2.1.0.x
expressionengine / expressionengine 2.6.0 2.6.0.x
expressionengine / expressionengine 3.3.0 3.3.0.x
expressionengine / expressionengine 2.10.2 2.10.2.x
expressionengine / expressionengine 2.7.3 2.7.3.x
expressionengine / expressionengine 2.5.0 2.5.0.x
expressionengine / expressionengine 2.1.3 2.1.3.x
expressionengine / expressionengine 3.5.1 3.5.1.x
expressionengine / expressionengine 3.1.4 3.1.4.x