CVE-2026-74879: Openssl Encrypt: güvenlik açığı

Açıklama (NVD)

openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection parameters, and potentially credentials from exception messages.

Özet bilgiler

Ürün

Jahlives Openssl Encrypt

CVSS v3.1

7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v4.0

8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

%0,44 (yüzdelik 39)

CWE

CWE-209

Yama

Geçici çözüm

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• www.vulncheck.com
• CWE-209