CVE-2014-1836

Опубликовано: 01 июл. 2015

Источник: nvd

CVSS2: 6.4

EPSS Средний

Описание

Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

Ссылки

http://community.impresscms.org/modules/smartsection/item.php?itemid=675
Vendor Advisory
http://osvdb.org/show/osvdb/102770
http://seclists.org/fulldisclosure/2014/Feb/14
http://www.securityfocus.com/bid/65279
https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt
Exploit
http://community.impresscms.org/modules/smartsection/item.php?itemid=675
Vendor Advisory
http://osvdb.org/show/osvdb/102770
http://seclists.org/fulldisclosure/2014/Feb/14
http://www.securityfocus.com/bid/65279
https://github.com/pedrib/PoC/blob/master/generic/impresscms-1.3.5.txt
Exploit

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:impresscms:impresscms:*:*:*:*:*:*:*:*

Версия до 1.3.5 (включая)

EPSS

Процентиль: 95%

0.18119

Средний

6.4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-wcj4-ff9m-5r7g

github

больше 3 лет назад

ImpressCMS Path Traversal to Arbitrary File Delete