CVE-2016-9835

Опубликовано: 05 дек. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.

Ссылки

http://www.securityfocus.com/bid/95005
Third Party Advisory
VDB Entry
https://github.com/zikula/core/blob/1.3/CHANGELOG-1.3.md
Issue Tracking
Patch
Release Notes
Third Party Advisory
https://github.com/zikula/core/blob/1.4/CHANGELOG-1.4.md
Issue Tracking
Patch
Release Notes
Third Party Advisory
https://github.com/zikula/core/issues/3237
Issue Tracking
Patch
Third Party Advisory
http://www.securityfocus.com/bid/95005
Third Party Advisory
VDB Entry
https://github.com/zikula/core/blob/1.3/CHANGELOG-1.3.md
Issue Tracking
Patch
Release Notes
Third Party Advisory
https://github.com/zikula/core/blob/1.4/CHANGELOG-1.4.md
Issue Tracking
Patch
Release Notes
Third Party Advisory
https://github.com/zikula/core/issues/3237
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:zikula:zikula_application_framework:1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.1:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.3:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.4:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.5:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.6:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.7:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.8:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.9:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.10:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.3.10:rc1:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc2:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc3:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc4:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.0:rc5:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.3:*:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.3:rc1:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.3:rc2:*:*:*:*:*:*

cpe:2.3:a:zikula:zikula_application_framework:1.4.3:rc3:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.03905

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-77

Связанные уязвимости

GHSA-2xj4-744c-pqqp