CVE-2017-18048

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-18048

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18048.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-18048

Published

2018-01-23T06:29:00.213Z

Modified

2026-07-08T15:10:56.391326Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.

References

Affected packages

Git / github.com/monstra-cms/monstra

Affected ranges

Type

GIT

Repo

https://github.com/monstra-cms/monstra

Events

Introduced

81bad8b6649253bd972ac4158816189d38366216

Last affected

81bad8b6649253bd972ac4158816189d38366216

Database specific

{
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "3.0.4"
        },
        {
            "last_affected": "3.0.4"
        }
    ],
    "cpe": "cpe:2.3:a:monstra:monstra:3.0.4:*:*:*:*:*:*:*"
}

Affected versions

3.*

3.0.4

v3.*

v3.0.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-18048.json"