PatchTheCVEtrovebox vulnerabilities and fixes
Recent CVEs affecting trovebox, with upgrade or downgrade steps. 4 tracked.
trovebox has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2018-06-26. Highest priority: CVE-2018-1000554 (score 61/100).
- CVE-2018-1000554 CRITICAL 9.8 UPGRADE Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user componen
- CVE-2018-1000553 HIGH 8.8 UPGRADE Trovebox version <= 4.0.0-rc6 contains a Server-Side request forgery vulnerability in webhook component that c
- CVE-2018-1000552 HIGH 8.8 UPGRADE Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL
- CVE-2018-1000551 HIGH 8.8 UPGRADE Trovebox version <= 4.0.0-rc6 contains a PHP Type juggling vulnerability in album view component that can resu
FAQ
How do I fix trovebox vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is trovebox being exploited right now?
None of the tracked trovebox CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which trovebox CVE should I patch first?
CVE-2018-1000554 currently ranks highest (61/100): Trovebox version <= 4.0.0-rc6 contains a Unsafe password reset token generation vulnerability in user componen.