4

I'm asking because I have roughly 30 sites, most of which were started before my tenure here, that will need to be updated if this version is as critical as they say.

It is hard for me to justify the time it will take to update all of these sites (all of which are different versions of EE as well, with different server structures, et al) without knowing how crucial this fix is.

I haven't found anything about it at EllisLab's blog or forum. Does anybody know?

Improve this question

1 Answer 1

Reset to default
3

Per the 2.7.2 change log:

Addressed a security issue where XIDs may not invalidate properly.

Based on that you can make your decision. But, you're right that it's not clear how far back they see this vulnerability reaching. EE folks will always tell you to update.

Improve this answer
2
  • 4
    Given the changes made in 2.7, I would hazard a guess that this fixes an issue introduced in 2.7, and doesn't mean there are security vulnerabilities in pre-2.7 versions.
    – Adrian Macneil
    Commented Oct 21, 2013 at 17:41
  • 2
    Yes, that's pretty much why I ask, anything post 2.7 upgrades easily and fine. Anything pre-2.7 has tons of hassles, but it looks like the XID issue isn't present in those pre 2.7 versions so this solves itself.
    – thatgibbyguy
    Commented Oct 21, 2013 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.