PT-2016-7835 · Zikula · Zikula

Xyntax · Published 2016-12-05 · Updated 2016-12-27 · CVE-2016-9835

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zikula versions 1.3.x through 1.3.10 Zikula versions 1.4.x through 1.4.3

Description A directory traversal issue in the file "jcss.php" allows a remote attacker to launch a PHP object injection by uploading a serialized file.

Recommendations For Zikula versions 1.3.x through 1.3.10, update to version 1.3.11 or later. For Zikula versions 1.4.x through 1.4.3, update to version 1.4.4 or later.

Fix

Command Injection

Improper Access Control

Weakness Enumeration

CWE-77

CWE-284

Related Identifiers

CVE-2016-9835

Affected Products

Zikula

References · 7

• https://github.com/zikula/core/issues/3237 · Patch
• https://github.com/zikula/core/blob/1.4/CHANGELOG-1.4.md · Patch
• https://github.com/zikula/core/blob/1.3/CHANGELOG-1.3.md · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-9835 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9835 · Vendor Advisory
• http://securityfocus.com/bid/95005 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9835 · Note