EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache
概要
EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com