PT-2016-7213 · Exponent · Exponent Cms

Balisong · Publicado 2016-11-03 · Atualizado 2018-02-27 · CVE-2016-7095

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9

Description The issue allows an attacker to upload a malicious script file using redirection, placing the script in an unprotected folder that permits script execution.

Recommendations For versions prior to 2.3.9, update to version 2.3.9 or later to resolve the issue.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2016-7095

Produtos afetados

Exponent Cms

Referências · 6

• https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0 · Nota
• http://exponentcms.org/news/security-vulnerability-all-exponent-versions-june-2016 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7095 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7095 · Nota de Segurança
• http://securityfocus.com/bid/94121 · Nota
• https://osv.dev/vulnerability/CVE-2016-7095 · Aviso do Fabricante