PT-2017-11013 · Unknown · Kindeditor

Larry W. Cashdollar + 1 · Publicado 2017-09-14 · Atualizado 2019-10-03 · CVE-2017-1002024

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kind Editor version 4.1.12

Description The issue concerns a lack of authentication check in the file upload functionality. Specifically, the kindeditor/php/upload json.php endpoint does not verify user authentication before allowing file uploads.

Recommendations For Kind Editor version 4.1.12, consider implementing authentication checks for the upload json.php file to ensure only authorized users can upload files. As a temporary workaround, restrict access to the kindeditor/php/upload json.php endpoint until a proper fix is applied.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-1002024

Produtos afetados

Kindeditor

Referências · 5

• 🔥 http://vapidlabs.com/advisory.php?v=195 · Exploit
• https://github.com/kindsoft/kindeditor · Correção
• https://osv.dev/vulnerability/CVE-2017-1002024 · Aviso do Fabricante
• http://kindeditor.org · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002024 · Nota de Segurança