PatchTheCVEgpweb vulnerabilities and fixes
Recent CVEs affecting gpweb, with upgrade or downgrade steps. 3 tracked.
gpweb has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 0. Most recent: 2017-12-19. Highest priority: CVE-2017-15877 (score 63/100).
- CVE-2017-15877 CRITICAL 9.8 DOWNGRADE Insecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view the password
- CVE-2017-15876 HIGH 7.2 DOWNGRADE Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of
- CVE-2017-15875 CRITICAL 9.8 DOWNGRADE SQL injection vulnerability in Password Recovery in GPWeb 8.4.61 allows remote attackers to execute arbitrary
FAQ
How do I fix gpweb vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gpweb being exploited right now?
None of the tracked gpweb CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gpweb CVE should I patch first?
CVE-2017-15877 currently ranks highest (63/100): Insecure Permissions vulnerability in db.php file in GPWeb 8.4.61 allows remote attackers to view the password.