{"action":"Upgrade arc/web to 3.0 or later.","affected":[{"fixed":"3.0","introduced":"0"}],"component":"arc/web","cve_ids":["CVE-2017-20157"],"ecosystem":"Packagist","epss":0.00725,"exploited":false,"fixed_versions":["3.0"],"ghsa_id":"GHSA-qr97-v87p-x965","id":"tcs_01M5KF7JN10R9Y6QGDRKHJ1BXR","modified_at":"2023-11-08T03:59:17.386981Z","published_at":"2022-12-31T12:30:20Z","references":["https://osv.dev/vulnerability/GHSA-qr97-v87p-x965","https://nvd.nist.gov/vuln/detail/CVE-2017-20157","https://github.com/Ariadne-CMS/arc-web/commit/1feb1cc11e6c9f218408f15f53f537ea0d788656","https://github.com/Ariadne-CMS/arc-web","https://github.com/Ariadne-CMS/arc-web/releases/tag/3.0","https://vuldb.com/?ctiid.217140","https://vuldb.com/?id.217140"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-qr97-v87p-x965","url":"https://osv.dev/vulnerability/GHSA-qr97-v87p-x965"}],"summary":"Ariadne Component Library vulnerable to Server-Side Request Forgery"}