exploitDog

CVE-2016-11020

Опубликовано: 25 фев. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.

Ссылки

https://github.com/Kunena/Kunena-Forum/pull/5028
Patch
Third Party Advisory
https://www.kunena.org/blog/179-kunena-5-0-4-released
Release Notes
Vendor Advisory
https://www.kunena.org/bugs/changelog
Release Notes
Vendor Advisory
https://github.com/Kunena/Kunena-Forum/pull/5028
Patch
Third Party Advisory
https://www.kunena.org/blog/179-kunena-5-0-4-released
Release Notes
Vendor Advisory
https://www.kunena.org/bugs/changelog
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:kunena:kunena:*:*:*:*:*:joomla\!:*:*

Версия до 5.0.4 (исключая)

EPSS

Процентиль: 87%

0.03391

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-gffh-9h9q-xv2h

github

больше 3 лет назад

Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS.

EPSS

Процентиль: 87%

0.03391

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-434