4

I'm asking because I have roughly 30 sites, most of which were started before my tenure here, that will need to be updated if this version is as critical as they say.

It is hard for me to justify the time it will take to update all of these sites (all of which are different versions of EE as well, with different server structures, et al) without knowing how crucial this fix is.

I haven't found anything about it at EllisLab's blog or forum. Does anybody know?

3

Per the 2.7.2 change log:

Addressed a security issue where XIDs may not invalidate properly.

Based on that you can make your decision. But, you're right that it's not clear how far back they see this vulnerability reaching. EE folks will always tell you to update.

| improve this answer | |
  • 4
    Given the changes made in 2.7, I would hazard a guess that this fixes an issue introduced in 2.7, and doesn't mean there are security vulnerabilities in pre-2.7 versions. – Adrian Macneil Oct 21 '13 at 17:41
  • 2
    Yes, that's pretty much why I ask, anything post 2.7 upgrades easily and fine. Anything pre-2.7 has tons of hassles, but it looks like the XID issue isn't present in those pre 2.7 versions so this solves itself. – thatgibbyguy Oct 21 '13 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.