CVE-2017-11466

Опубликовано: 20 июл. 2017

Источник: nvd

CVSS3: 7.2

CVSS2: 9

EPSS Низкий

Описание

Arbitrary file upload vulnerability in com/dotmarketing/servlets/AjaxFileUploadServlet.class in dotCMS 4.1.1 allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter to servlets/ajax_file_upload. This results in arbitrary code execution by requesting the .jsp file at a /assets URI.

Ссылки

http://seclists.org/fulldisclosure/2017/Jul/33
Exploit
Mailing List
Third Party Advisory
https://github.com/dotCMS/core/issues/12131
Issue Tracking
Patch
Third Party Advisory
https://packetstormsecurity.com/files/143383/dotcms411-shell.txt
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2017/Jul/33
Exploit
Mailing List
Third Party Advisory
https://github.com/dotCMS/core/issues/12131
Issue Tracking
Patch
Third Party Advisory
https://packetstormsecurity.com/files/143383/dotcms411-shell.txt
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dotcms:dotcms:4.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 87%

0.03263

Низкий

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-234x-7qj3-r3fj