PT-2016-7338 · Pixidou+1 · Pixidou Image Editor+1

Manuel Garcia Cardenas · Publicado 2016-11-03 · Atualizado 2018-02-27 · CVE-2016-7452

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 patch 2

Description The issue allows an attacker to upload a malicious file to any folder on the site via a cpi directory traversal in the Pixidou Image Editor.

Recommendations For versions prior to 2.3.9 patch 2, update to version 2.3.9 patch 2 or later to resolve the issue.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2016-7452

Produtos afetados

Exponent Cms

Pixidou Image Editor

Referências · 6

• https://github.com/exponentcms/exponent-cms/commit/c1092f167cc6c78dc8bf9bf149946c5219413df3 · Correção
• https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0 · Nota
• http://securityfocus.com/bid/93045 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7452 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7452 · Nota
• https://osv.dev/vulnerability/CVE-2016-7452 · Aviso do Fabricante