CVE-2017-0897CWE-330

ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy

published June 22, 2017

CVSS
—
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04042 · 90.5th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2017-06-22T21:00Z
EPSS history
Timeline
  • 22 JUN 21:00Z
    ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy
    cvelistv5