PT-2017-11013 · Unknown · Kindeditor

Larry W. Cashdollar + 1 · Published 2017-09-14 · Updated 2019-10-03 · CVE-2017-1002024

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kind Editor version 4.1.12

Description The issue concerns a lack of authentication check in the file upload functionality. Specifically, the kindeditor/php/upload json.php endpoint does not verify user authentication before allowing file uploads.

Recommendations For Kind Editor version 4.1.12, consider implementing authentication checks for the upload json.php file to ensure only authorized users can upload files. As a temporary workaround, restrict access to the kindeditor/php/upload json.php endpoint until a proper fix is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-1002024

Affected Products

Kindeditor

References · 5

• 🔥 http://vapidlabs.com/advisory.php?v=195 · Exploit
• https://github.com/kindsoft/kindeditor · Patch
• https://osv.dev/vulnerability/CVE-2017-1002024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1002024 · Security Note
• http://kindeditor.org · Note