PT-2017-18913 · Bigtree · Bigtree Cms

Xfkxfk · Publicado 2017-06-04 · Atualizado 2017-06-06 · CVE-2017-9428

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigTree CMS versions prior to 4.2.19

Description A directory traversal issue exists, allowing attackers to read arbitrary files via .. sequences in the directory parameter. This is due to a vulnerability in the coreadminajaxdeveloperextensionsfile-browser.php file.

Recommendations For BigTree CMS versions prior to 4.2.19, update to version 4.2.19 or later to resolve the issue. As a temporary workaround, consider restricting access to the file-browser.php file to minimize the risk of exploitation. Avoid using the directory parameter in the affected API endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-9428

Produtos afetados

Bigtree Cms

Referências · 4

• 🔥 https://github.com/bigtreecms/BigTree-CMS/issues/289 · Exploit
• https://osv.dev/vulnerability/CVE-2017-9428 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9428 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9428 · Nota