CVE-2017-11717

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

MetInfo through 5.3.17 accepts the same CAPTCHA response for 120 seconds, which makes it easier for remote attackers to bypass intended challenge requirements by modifying the client-server data stream, as demonstrated by the login/findpass page.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lncken.cn/?p=343Third Party Advisory
https://lncken.cn/?p=343Third Party Advisory

Timeline

Published: Jul 28, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-117186.1There is URL Redirector Abuse in MetInfo through 5.3.17 via the gourl parameter to member/login.php.CVE-2017-117197.8The dnxhd_decode_header function in libavcodec/dnxhddec.c in FFmpeg 3.0 through 3.3.2 allows remote attackers to cause a denial of service (CVE-2017-117209.8There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.CVE-2017-117219.8Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to cause a denial of service (application crash) or possibly have unsp CVE-2017-117226.5The WriteOnePNGImage function in coders/png.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (out-of-bounds r CVE-2017-117237.5Directory traversal vulnerability in plugins/ImageManager/backend.php in Xinha 0.96, as used in Jojo 4.4.0, allows remote attackers to delet CVE-2017-117246.5The ReadMATImage function in coders/mat.c in ImageMagick through 6.9.9-3 and 7.x through 7.0.6-3 has memory leaks involving the quantum_info CVE-2017-117255.4The share function in Thycotic Secret Server before 10.2.000019 mishandles the Back Button, leading to unintended redirections.CVE-2017-117268.8services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstr CVE-2017-117276.1services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involv CVE-2017-117285.5A heap-based buffer over-read was found in the function OpCode (called from decompileSETMEMBER) in util/decompile.c in Ming 0.4.8, which all CVE-2017-117295.5A heap-based buffer over-read was found in the function OpCode (called from decompileINCR_DECR line 1440) in util/decompile.c in Ming 0.4.8,