PatchTheCVEplataformatec vulnerabilities
Recent CVEs affecting plataformatec products. 3 tracked.
plataformatec has 3 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 3. Most recent: 2019-09-30. Highest priority: CVE-2019-16676 (score 67/100).
- CVE-2019-5421 CRITICAL 9.8 UPGRADE Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in
- CVE-2019-16676 CRITICAL 9.8 UPGRADE Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, bec
- CVE-2019-16109 MEDIUM 5.3 UPGRADE An issue was discovered in Plataformatec Devise before 4.7.1
FAQ
How do I fix plataformatec vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is plataformatec being exploited right now?
None of the tracked plataformatec CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which plataformatec CVE should I patch first?
CVE-2019-16676 currently ranks highest (67/100): Plataformatec Simple Form has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb, bec.