PT-2022-17957 · Unknown · Halo Blog Cms

Ziping21 · Published 2022-04-05 · Updated 2022-04-12 · CVE-2022-26619

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Halo Blog CMS version 1.4.17

Description The issue allows attackers to upload arbitrary files via the Attachment Upload function. This can potentially lead to unauthorized access or malicious activities on the system.

Recommendations For Halo Blog CMS version 1.4.17, consider disabling the Attachment Upload function until a patch is available to prevent arbitrary file uploads. Restrict access to the upload functionality to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-26619

Affected Products

Halo Blog Cms

References · 4

• 🔥 https://github.com/halo-dev/halo/issues/1702 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26619 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26619 · Vendor Advisory
• https://t.me/cvenotify/28740 · Telegram Post