CVE-2016-9187

Опубликовано: 04 нояб. 2016

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.

Ссылки

http://www.securityfocus.com/bid/94191
Third Party Advisory
VDB Entry
https://packetstormsecurity.com/files/139466/Moodle-CMS-3.1.2-Cross-Site-Scripting-File-Upload.html
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/94191
Third Party Advisory
VDB Entry
https://packetstormsecurity.com/files/139466/Moodle-CMS-3.1.2-Cross-Site-Scripting-File-Upload.html
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*

Версия до 3.1.2 (включая)

EPSS

Процентиль: 90%

0.0397

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

CVE-2016-9187

CVSS3: 8.8

ubuntu

почти 10 лет назад

CVE-2016-9187

CVSS3: 8.8

debian

почти 10 лет назад

Unrestricted file upload vulnerability in the double extension support ...

GHSA-58fm-v4pr-jh8p

CVSS3: 8.8

github

больше 4 лет назад

Moodle Unrestricted file upload vulnerability

EPSS

Процентиль: 90%

0.0397

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434