exploitDog

CVE-2015-7773

Опубликовано: 20 нояб. 2015

Источник: nvd

CVSS2: 6.5

EPSS Низкий

Описание

Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension.

Комментарий

CWE-434: Unrestricted Upload of File with Dangerous Type

Ссылки

http://getkirby.com/changelog/kirby-2-1-2
Patch
Vendor Advisory
http://jvn.jp/en/jp/JVN34780384/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000182
Vendor Advisory
http://getkirby.com/changelog/kirby-2-1-2
Patch
Vendor Advisory
http://jvn.jp/en/jp/JVN34780384/index.html
Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000182
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bastian_allgeier:kirby:*:*:*:*:*:*:*:*

Версия до 2.1.1 (включая)

EPSS

Процентиль: 63%

0.00442

Низкий

6.5 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-hqg9-wjj6-h4ff

github

больше 3 лет назад

Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension.

EPSS

Процентиль: 63%

0.00442

Низкий

6.5 Medium

CVSS2

Дефекты

NVD-CWE-Other