Описание
An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.
Ссылки
- Broken Link
- PatchThird Party Advisory
- Product
- Broken Link
- PatchThird Party Advisory
- Product
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:sysaid:sysaid:20.4.74:b10:*:*:*:*:*:*
EPSS
Процентиль: 74%
0.00827
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-434
Связанные уязвимости
github
около 4 лет назад
An unrestricted file upload vulnerability in /UploadPsIcon.jsp in SysAid ITIL 20.4.74 b10 allows a remote authenticated attacker to upload an arbitrary file via the file parameter in the HTTP POST body. A successful request returns the absolute, server-side filesystem path of the uploaded file.
EPSS
Процентиль: 74%
0.00827
Низкий
8.8 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-434