CVE-2017-1000053
HIGHElixir Plug <v1.0.4,v1.1.7,v1.2.3,v1.3.2 - Code Injection
Title source: llmDescription
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.
References (1)
Core 1
Core References
Mitigation, Third Party Advisory x_refsource_confirm
https://elixirforum.com/t/security-releases-for-plug/3913
Scores
CVSS v3
8.1
EPSS
0.0193
EPSS Percentile
77.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-502
Status
published
Products (2)
Hex/plug
0 - 1.0.4Hex
plug_project/plug
1.0.0 - 1.0.4
Published
Jul 17, 2017
Tracked Since
Feb 18, 2026