CVEvulnerability
CVE-2017-12905
10.0 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-09-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-918
Description
Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.
Affected configurations
• vebto pixie - image editor 1.4
• vebto pixie - image editor 1.7
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- http://seclists.org/fulldisclosure/2017/Sep/47 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2017/Sep/47 Mailing List, Third Party Advisory