PatchTheCVEcanopy vulnerabilities and fixes
Recent CVEs affecting canopy, with upgrade or downgrade steps. 2 tracked.
canopy has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2021-06-18. Highest priority: CVE-2021-34815 (score 36/100).
- CVE-2021-34815 MEDIUM 4.8 UPGRADE CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter
- CVE-2018-9036 MEDIUM 4.8 UPGRADE CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Login Page Disclaimer, allowing attacks by low-privile
FAQ
How do I fix canopy vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is canopy being exploited right now?
None of the tracked canopy CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which canopy CVE should I patch first?
CVE-2021-34815 currently ranks highest (36/100): CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter.