Описание
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature (ZipSlip). In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability is fixed in 0.24.0.
Ссылки
- Patch
- Issue Tracking
- Release Notes
- ExploitVendor Advisory
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 0.21.0 (включая) до 0.24.0 (исключая)
cpe:2.3:a:docmost:docmost:*:*:*:*:*:*:*:*
EPSS
Процентиль: 17%
0.00054
Низкий
7.1 High
CVSS3
9.8 Critical
CVSS3
Дефекты
CWE-22
EPSS
Процентиль: 17%
0.00054
Низкий
7.1 High
CVSS3
9.8 Critical
CVSS3
Дефекты
CWE-22