CVE-2018-1000619

Опубликовано: 09 июл. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

Ovidentia version 8.4.3 and earlier contains a Unsanitized User Input vulnerability in utilit.php, bab_getAddonFilePathfromTg that can result in Authenticated Remote Code Execution. This attack appear to be exploitable via The attacker must have permission to upload addons.

Ссылки

https://drive.google.com/open?id=195h-LirGiIVKxioyusw3SvmLp8BljPxe
Technical Description
Third Party Advisory
https://www.ovidentia.org/index.php?
Vendor Advisory
https://www.ovidentia.org/modules
Vendor Advisory
https://drive.google.com/open?id=195h-LirGiIVKxioyusw3SvmLp8BljPxe
Technical Description
Third Party Advisory
https://www.ovidentia.org/index.php?
Vendor Advisory
https://www.ovidentia.org/modules
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:ovidentia:ovidentia:*:*:*:*:*:*:*:*

Версия до 8.4.3 (включая)

EPSS

Процентиль: 85%

0.02622

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-59c9-ppc4-4v7h