Arbitrary Code Execution Affecting plug package, versions >=1.3.0 <1.3.2 >=1.2.0-rc.0 <1.2.3 >=1.1.0 <1.1.7 <1.0.4
Snyk CVSS
Attack Complexity
High
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.25% (65th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-HEX-PLUG-1088058
- published 30 Mar 2021
- disclosed 28 Feb 2017
- credit Griffin Byatt, Matthew Diaz
Introduced: 28 Feb 2017
CVE-2017-1000053 Open this link in a new tabHow to fix?
Upgrade plug to version 1.3.2, 1.2.3, 1.1.7, 1.0.4 or higher.
Overview
plug is a specification and conveniences for composable modules between web applications.
Affected versions of this package are vulnerable to Arbitrary Code Execution. The default serialization used by Plug session may result in code execution in certain situations. This attack can only be exploited if the attacker has access to your secret key as well as your signing/encryption salts as the session cookie is signed.