PT-2023-14430 · Unknown · B2Evolution

Mzwebo · Publicado 2023-01-03 · Atualizado 2024-08-03 · CVE-2022-44036

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions b2evolution version 7.2.5

Description The issue allows for arbitrary file upload, leading to command execution, when configured with admins can manipulate sensitive files. This is considered a feature by the vendor, but it can be exploited by attackers to execute remote commands. The vendor suggests that disabling the feature is an obvious solution for those who do not want it.

Recommendations For b2evolution version 7.2.5, consider disabling the admins can manipulate sensitive files feature to prevent arbitrary file upload and command execution.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2022-44036

Produtos afetados

B2Evolution

Referências · 7

• 🔥 https://github.com/b2evolution/b2evolution/issues/121 · Exploit
• https://t.me/cvenotify/86355 · Publicação no Telegram
• https://t.me/cvenotify/88780 · Publicação no Telegram
• https://t.me/cibsecurity/55842 · Publicação no Telegram
• https://t.me/cvenotify/41234 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-44036 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-44036 · Nota de Segurança