CVE-2017-7178
CVE-2017-7178
This page contains facts from public vulnerability sources. Check the original advisory before updating.
CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its __init__.py file and (2) causing the victim to download, install, and enable this plugin.
CVSS 8.8 · High · EPSS 4.0% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
deluge Debian:12
- Affected ranges
- ECOSYSTEM: < 1.3.13+git20161130.48cedf63-2
Update to 1.3.13+git20161130.48cedf63-2
deluge Debian:13
- Affected ranges
- ECOSYSTEM: < 1.3.13+git20161130.48cedf63-2
Update to 1.3.13+git20161130.48cedf63-2
deluge Debian:14
- Affected ranges
- ECOSYSTEM: < 1.3.13+git20161130.48cedf63-2
Update to 1.3.13+git20161130.48cedf63-2
deluge Ubuntu:16.04:LTS
- Versions
- 1.3.12-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://git.deluge-torrent.org/deluge/commit/?h=develop&id=11e8957deaf0c76fdfbac62d99c8b6c61cfdddf9
- http://dev.deluge-torrent.org/wiki/ReleaseNotes/1.3.14
- http://www.securityfocus.com/bid/97041
- https://bugs.debian.org/857903
- http://seclists.org/fulldisclosure/2017/Mar/6
- http://www.debian.org/security/2017/dsa-3856
- https://security.gentoo.org/glsa/201703-06
- http://git.deluge-torrent.org/deluge/commit/?h=1.3-stable&id=318ab179865e0707d7945edc3a13a464a108d583
- https://nvd.nist.gov/vuln/detail/CVE-2017-7178