CVE-2017-7694

Опубликовано: 11 апр. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor.

Ссылки

http://www.math1as.com/symphonycms_2.7_exec.txt
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/97594
Third Party Advisory
VDB Entry
https://github.com/symphonycms/symphony-2/commit/e30a18f8f09dca836e141bf126a26e565c9a2bc7
Patch
https://github.com/symphonycms/symphony-2/issues/2655
Issue Tracking
Patch
http://www.math1as.com/symphonycms_2.7_exec.txt
Exploit
Third Party Advisory
http://www.securityfocus.com/bid/97594
Third Party Advisory
VDB Entry
https://github.com/symphonycms/symphony-2/commit/e30a18f8f09dca836e141bf126a26e565c9a2bc7
Patch
https://github.com/symphonycms/symphony-2/issues/2655
Issue Tracking
Patch

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:getsymphony:symphony:*:*:*:*:*:*:*:*

Версия до 2.6.11 (включая)

EPSS

Процентиль: 90%

0.05424

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

GHSA-4c8f-vrv5-3jh4