CVE-2016-10038

Опубликовано: 24 дек. 2016

Источник: nvd

CVSS3: 7.3

CVSS2: 7.5

EPSS Низкий

Описание

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.

Ссылки

http://www.securityfocus.com/bid/95097
Third Party Advisory
VDB Entry
https://github.com/modxcms/revolution/pull/13177
Patch
Vendor Advisory
https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt
Release Notes
http://www.securityfocus.com/bid/95097
Third Party Advisory
VDB Entry
https://github.com/modxcms/revolution/pull/13177
Patch
Vendor Advisory
https://raw.githubusercontent.com/modxcms/revolution/v2.5.2-pl/core/docs/changelog.txt
Release Notes

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:modx:modx_revolution:*:*:*:*:*:*:*:*

Версия до 2.5.1-pl (включая)

EPSS

Процентиль: 73%

0.00792

Низкий

7.3 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-xxpp-89v4-96px