exploitDog

CVE-2015-2994

Опубликовано: 08 июн. 2015

Источник: nvd

CVSS2: 6.5

EPSS Высокий

Описание

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.

Комментарий

CWE-434: Unrestricted Upload of File with Dangerous Type

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sysaid:sysaid:*:*:*:*:*:*:*:*

Версия до 15.1 (включая)

EPSS

Процентиль: 99%

0.76861

Высокий

6.5 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-g763-4gcm-875f

github

больше 3 лет назад

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/user_photo/.

EPSS

Процентиль: 99%

0.76861

Высокий

6.5 Medium

CVSS2

Дефекты

NVD-CWE-Other