GHSA-mwh6-g9wx-xcx3

Source

https://github.com/advisories/GHSA-mwh6-g9wx-xcx3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-mwh6-g9wx-xcx3/GHSA-mwh6-g9wx-xcx3.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mwh6-g9wx-xcx3

Aliases

CVE-2017-20063

Published

2022-06-21T00:00:48Z

Modified

2023-11-08T03:59:17.137159Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Unrestricted Upload of File with Dangerous Type in Elefant CMS

Details

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.

Database specific

{
    "nvd_published_at": "2022-06-20T05:15:00Z",
    "github_reviewed_at": "2022-06-29T22:09:05Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-434"
    ]
}

References

Affected packages

Packagist / elefant/cms

Package

Name: elefant/cms
Purl: pkg:composer/elefant/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.13