CVE-2017-1002024

Опубликовано: 14 сент. 2017

Источник: nvd

CVSS3: 4.3

CVSS2: 4

EPSS Низкий

Описание

Vulnerability in web application Kind Editor v4.1.12, kindeditor/php/upload_json.php does not check authentication before allow users to upload files.

Ссылки

http://kindeditor.org
Product
http://www.vapidlabs.com/advisory.php?v=195
Exploit
Third Party Advisory
https://github.com/kindsoft/kindeditor
Patch
Third Party Advisory
http://kindeditor.org
Product
http://www.vapidlabs.com/advisory.php?v=195
Exploit
Third Party Advisory
https://github.com/kindsoft/kindeditor
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:kindsoft:kind_editor:*:*:*:*:*:*:*:*

Версия до 3.5.6 (включая)

cpe:2.3:a:kindsoft:kind_editor:4.0:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.0.6:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.6:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.7:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.8:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.9:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.10:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kind_editor:4.1.11:*:*:*:*:*:*:*

cpe:2.3:a:kindsoft:kindeditor:4.1.12:*:*:*:*:*:*:*

EPSS

Процентиль: 53%

0.00297

Низкий

4.3 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-q932-hr86-c9wg