PT-2022-24346 · Cuppacms · Cuppacms

4Dministrat0R + 3 · Published 2022-09-12 · Updated 2022-09-15 · CVE-2022-38296

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cuppa CMS version 1.0

Description The issue is related to an arbitrary file upload vulnerability via the File Manager. This allows for potential malicious file uploads.

Recommendations For Cuppa CMS version 1.0, consider disabling the File Manager until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to the File Manager to minimize the risk of malicious file uploads.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-38296

Affected Products

Cuppacms

References · 4

• 🔥 https://github.com/CuppaCMS/CuppaCMS/issues/33 · Exploit
• https://osv.dev/vulnerability/CVE-2022-38296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38296 · Security Note
• https://t.me/cibsecurity/49618 · Telegram Post