CVE-2018-11736

Опубликовано: 05 июн. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file.

Ссылки

https://github.com/pluck-cms/pluck/issues/61
Exploit
Third Party Advisory
https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2
Release Notes
Third Party Advisory
https://github.com/pluck-cms/pluck/issues/61
Exploit
Third Party Advisory
https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2
Release Notes
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pluck-cms:pluck:*:*:*:*:*:*:*:*

Версия до 4.7.7 (включая)

Конфигурация 2

cpe:2.3:a:pluck-cms:pluck:4.7.7:dev1:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.11915

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-4ggg-q2gv-3w5v