PatchTheCVEallen disk vulnerabilities and fixes
Recent CVEs affecting allen disk, with upgrade or downgrade steps. 6 tracked.
Also searched as: allendisk.
allen disk has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2017-05-31. Highest priority: CVE-2017-9091 (score 49/100).
- CVE-2017-9307 MEDIUM 6.5 DOWNGRADE SSRF vulnerability in remotedownload.php in Allen Disk 1.6 allows remote authenticated users to conduct port s
- CVE-2017-9249 MEDIUM 5.4 DOWNGRADE Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitra
- CVE-2017-9091 HIGH 7.5 DOWNGRADE /admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to
- CVE-2017-9090 HIGH 7.5 DOWNGRADE reg.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code'])==1, which makes it possible to
- CVE-2017-8848 MEDIUM 6.5 DOWNGRADE Allen Disk 1.6 has CSRF in setpass.php with an impact of changing a password.
- CVE-2017-8832 MEDIUM 6.1 DOWNGRADE Allen Disk 1.6 has XSS in the id parameter to downfile.php.
FAQ
How do I fix allen disk vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is allen disk being exploited right now?
None of the tracked allen disk CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which allen disk CVE should I patch first?
CVE-2017-9091 currently ranks highest (49/100): /admin/loginc.php in Allen Disk 1.6 doesn't check if isset($_SESSION['captcha']['code']) == 1, which leads to .