CVE-2017-20178 Codiad process.php saveJSON information disclosure

What is CVE-2017-20178?

CVE-2017-20178 is a low-severity vulnerability in Codiad, published on 21 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 2.8.1 is able to address this issue. The patch is identified as 517119de673e62547ee472a730be0604f44342b5. It is recommended to upgrade the affected component. VDB-221498 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Weakness: CWE-200

Which versions are affected by CVE-2017-20178?

2 open source packages ship an affected version, including codiad/codiad. It affects 1 product.

Products include Codiad Codiad.

How do I fix CVE-2017-20178?

Upgrade codiad/codiad to 2.8.1 or later.

Is CVE-2017-20178 being exploited?

There is no known exploitation of CVE-2017-20178 in the wild and no public exploit code.

Other vulnerabilities in Codiad

• CVE-2019-19208 Code injection in codiad Critical 9.8
• CVE-2018-14009 Codiad remote code execution vulnerability Critical 9.8
• CVE-2017-11366 Codiad Vulnerable to Shell Command Injection Critical 9.8
• CVE-2020-14043 Codiad CSRF Vulnerability High 8.8
• CVE-2020-23355 Codiad Vulnerable to PHP Magic Hash Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2q79-56rq-8v3c.