PT-2017-13779 · Pivotx · Pivotx

Hansfn · Publicado 2017-10-01 · Atualizado 2017-10-06 · CVE-2017-14958

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PivotX version 2.3.11

Description The issue concerns the improper blocking of uploads of dangerous file types by admin users in lib.php, allowing remote PHP code execution via an upload of a .php file.

Recommendations For PivotX version 2.3.11, update to a version that properly blocks uploads of dangerous file types to prevent remote PHP code execution.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-14958

Produtos afetados

Pivotx

Referências · 3

• https://osv.dev/vulnerability/CVE-2017-14958 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14958 · Nota de Segurança
• https://sourceforge.net/p/pivot-weblog/code/4490 · Correção