CVE-2016-9268

Опубликовано: 10 нояб. 2016

Источник: nvd

CVSS3: 7.2

CVSS2: 9

EPSS Низкий

Описание

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.

Ссылки

http://dev.dotclear.org/2.0/changeset/445e9ff79a1fa81033591761d6a340e219d159b2
Issue Tracking
Patch
http://dev.dotclear.org/2.0/ticket/2214
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/94246
Third Party Advisory
VDB Entry
http://dev.dotclear.org/2.0/changeset/445e9ff79a1fa81033591761d6a340e219d159b2
Issue Tracking
Patch
http://dev.dotclear.org/2.0/ticket/2214
Mitigation
Vendor Advisory
http://www.securityfocus.com/bid/94246
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dotclear:dotclear:*:*:*:*:*:*:*:*

Версия до 2.10.4 (включая)

EPSS

Процентиль: 75%

0.00875

Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-434

Связанные уязвимости

CVE-2016-9268

CVSS3: 7.2

debian

около 9 лет назад

Unrestricted file upload vulnerability in the Blog appearance in the " ...

GHSA-h2r2-3pcg-323x

CVSS3: 7.2

github

больше 3 лет назад

EPSS

Процентиль: 75%

0.00875

Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-434