Vulnerability Description
The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hotfix-4, 4.0.7, 4.0.9 before hotfix-19, 4.4.x before 4.4.2 hotfix-1, 4.5.x before 4.5.3 hotfix-1, and Gateway Community and Enterprise Editions before 5.6.0 allow remote attackers to bypass intended access restrictions and obtain sensitive information via vectors related to HTTP request handling.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kaazing | Kaazing Gateway | < 4.5.3 |
| Tenefit | Kaazing Websocket Gateway | < 5.6.0 |
Related Weaknesses (CWE)
References
- https://support.kaazing.com/hc/en-us/articles/115004752368MitigationVendor Advisory
- https://support.kaazing.com/hc/en-us/articles/115004752368MitigationVendor Advisory
FAQ
What is CVE-2017-6910?
CVE-2017-6910 is a vulnerability with a CVSS score of 7.5 (HIGH). The HTTP and WebSocket engine components in the server in Kaazing Gateway before 4.5.3 hotfix-1, Gateway - JMS Edition before 4.0.5 hotfix-15, 4.0.6 before hotfix-4, 4.0.7, 4.0.9 before hotfix-19, 4.4...
How severe is CVE-2017-6910?
CVE-2017-6910 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-6910?
Check the references section above for vendor advisories and patch information. Affected products include: Kaazing Kaazing Gateway, Tenefit Kaazing Websocket Gateway.