esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.
References
Link | Resource |
---|---|
https://github.com/esigate/esigate/issues/209 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2022-10-03T16:21:59
Updated: 2022-10-03T16:21:59
Reserved: 2018-10-19T00:00:00
Link: CVE-2018-1000854
JSON object: View
NVD Information
Status : Analyzed
Published: 2018-12-20T17:29:00.267
Modified: 2019-01-07T15:16:40.880
Link: CVE-2018-1000854
JSON object: View
Redhat Information
No data.
CWE