CVE-2018-19197

Опубликовано: 12 нояб. 2018

Источник: nvd

CVSS3: 4.9

CVSS2: 5.5

EPSS Низкий

Описание

An issue was discovered in XiaoCms 20141229. admin\controller\database.php allows arbitrary directory deletion via admin/index.php?c=database&a=import&paths[]=../ directory traversal.

Ссылки

https://github.com/AvaterXXX/XiaoCms/blob/master/DIR_DEL.md
Exploit
Third Party Advisory
https://www.patec.cn/newsshow.php?cid=24&id=136
Broken Link
Third Party Advisory
https://github.com/AvaterXXX/XiaoCms/blob/master/DIR_DEL.md
Exploit
Third Party Advisory
https://www.patec.cn/newsshow.php?cid=24&id=136
Broken Link
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:xiaocms:xiaocms:20141229:*:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.00764

Низкий

4.9 Medium

CVSS3

5.5 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-j56h-5488-m369