PT-2016-7338 · Pixidou+1 · Pixidou Image Editor+1

Manuel Garcia Cardenas · Published 2016-11-03 · Updated 2018-02-27 · CVE-2016-7452

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 patch 2

Description The issue allows an attacker to upload a malicious file to any folder on the site via a cpi directory traversal in the Pixidou Image Editor.

Recommendations For versions prior to 2.3.9 patch 2, update to version 2.3.9 patch 2 or later to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2016-7452

Affected Products

Exponent Cms

Pixidou Image Editor

References · 6

• https://github.com/exponentcms/exponent-cms/commit/c1092f167cc6c78dc8bf9bf149946c5219413df3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-7452 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7452 · Vendor Advisory
• https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0 · Note
• http://securityfocus.com/bid/93045 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7452 · Note