PT-2018-13109 · Elefant · Elefant Cms

Publicado 2018-08-21 · Atualizado 2022-05-14 · CVE-2018-15601

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elefant CMS version 2.0.3

Description The issue arises from the apps/filemanager/handlers/upload/drop.php file in Elefant CMS, where a urldecode step is performed too late in the protection mechanism against uploading executable files. This could potentially allow malicious files to be uploaded.

Recommendations For Elefant CMS version 2.0.3, consider disabling the drop.php handler in the file manager until a patch is available to address the issue with the urldecode step timing. Restrict access to the file upload functionality to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-15601

GHSA-PCF7-5974-VJH4

Produtos afetados

Elefant Cms

Referências · 4

• https://github.com/jbroadway/elefant/commit/afb3346e50b992bcba143660ca2149e563430e05 · Correção
• https://osv.dev/vulnerability/GHSA-pcf7-5974-vjh4 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-15601 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15601 · Aviso do Fabricante