CVE-2018-11331

Опубликовано: 21 мая 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.

Ссылки

https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e
Patch
Third Party Advisory
https://github.com/pluck-cms/pluck/issues/58
Issue Tracking
Patch
Third Party Advisory
https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e
Patch
Third Party Advisory
https://github.com/pluck-cms/pluck/issues/58
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pluck-cms:pluck:*:*:*:*:*:*:*:*

Версия до 4.7.6 (исключая)

EPSS

Процентиль: 72%

0.00741

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-8v5g-x5hv-26fq