Описание
Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for professor.php.
Ссылки
- Vendor Advisory
- ExploitThird Party Advisory
- Vendor Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 3.6.15.4 (включая)
cpe:2.3:a:efrontlearning:efront:*:*:*:*:*:*:*:*
EPSS
Процентиль: 45%
0.00224
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-434
Связанные уязвимости
CVSS3: 6.5
github
больше 3 лет назад
Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for professor.php.
EPSS
Процентиль: 45%
0.00224
Низкий
6.5 Medium
CVSS3
4 Medium
CVSS2
Дефекты
CWE-434