CVE-2018-10063

Опубликовано: 12 апр. 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when exporting a Leads file.

Ссылки

https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/convert-forms/
Third Party Advisory
https://www.exploit-db.com/exploits/44447/
Exploit
Third Party Advisory
VDB Entry
https://www.tassos.gr/blog/convert-forms-2-0-4-security-release
Third Party Advisory
https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/convert-forms/
Third Party Advisory
https://www.exploit-db.com/exploits/44447/
Exploit
Third Party Advisory
VDB Entry
https://www.tassos.gr/blog/convert-forms-2-0-4-security-release
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:convert_forms_project:convert_forms:*:*:*:*:*:joomla\!:*:*

Версия до 2.0.4 (исключая)

EPSS

Процентиль: 87%

0.03344

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-7j5j-g8gf-289v