CVE-2014-5468

Опубликовано: 07 фев. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Средний

Описание

A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let a remote malicious user obtain sensitive information or execute arbitrary code.

Ссылки

http://packetstormsecurity.com/files/128234/Railo-4.2.1-Remote-File-Inclusion.html
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/34669
Exploit
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95959
Third Party Advisory
VDB Entry
https://vulmon.com/vulnerabilitydetails?qid=CVE-2014-5468
Third Party Advisory
https://www.securityfocus.com/bid/69761
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/128234/Railo-4.2.1-Remote-File-Inclusion.html
Exploit
Third Party Advisory
VDB Entry
http://www.exploit-db.com/exploits/34669
Exploit
Third Party Advisory
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/95959
Third Party Advisory
VDB Entry
https://vulmon.com/vulnerabilitydetails?qid=CVE-2014-5468
Third Party Advisory
https://www.securityfocus.com/bid/69761
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:getrailo:railo:*:*:*:*:*:*:*:*

Версия до 4.2.1.000 (включая)

EPSS

Процентиль: 98%

0.65256

Средний

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-rcww-wv7r-4c78

github

больше 3 лет назад