CVE Daily

CVE-2016-9268

Unrestricted file upload vulnerability in the Blog appearance in the "Install or...

High CVSS 7.2

Overview

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension, and then accessing it via unspecified vectors.

CWE: CWE-434 Published: 2016-11-10T20:59:00.177
Risk analysis

This vulnerability is rated 🟠 HIGH.

  • CVSS: 7.2 (HIGH)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags