PT-2017-13779 · Pivotx · Pivotx

Hansfn · Published 2017-10-01 · Updated 2017-10-06 · CVE-2017-14958

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PivotX version 2.3.11

Description The issue concerns the improper blocking of uploads of dangerous file types by admin users in lib.php, allowing remote PHP code execution via an upload of a .php file.

Recommendations For PivotX version 2.3.11, update to a version that properly blocks uploads of dangerous file types to prevent remote PHP code execution.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-14958

Affected Products

Pivotx

References · 3

• https://osv.dev/vulnerability/CVE-2017-14958 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14958 · Security Note
• https://sourceforge.net/p/pivot-weblog/code/4490 · Patch