PT-2023-14430 · Unknown · B2Evolution

Mzwebo · Published 2023-01-03 · Updated 2024-08-03 · CVE-2022-44036

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions b2evolution version 7.2.5

Description The issue allows for arbitrary file upload, leading to command execution, when configured with admins can manipulate sensitive files. This is considered a feature by the vendor, but it can be exploited by attackers to execute remote commands. The vendor suggests that disabling the feature is an obvious solution for those who do not want it.

Recommendations For b2evolution version 7.2.5, consider disabling the admins can manipulate sensitive files feature to prevent arbitrary file upload and command execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-44036

Affected Products

B2Evolution

References · 7

• 🔥 https://github.com/b2evolution/b2evolution/issues/121 · Exploit
• https://osv.dev/vulnerability/CVE-2022-44036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44036 · Security Note
• https://t.me/cvenotify/86355 · Telegram Post
• https://t.me/cvenotify/88780 · Telegram Post
• https://t.me/cibsecurity/55842 · Telegram Post
• https://t.me/cvenotify/41234 · Telegram Post