CVE Daily

CVE-2018-20604

Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ...

Medium CVSS 4.9

Overview

Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs, as demonstrated by the admin.php?s=/Template/edit/path/*web*..*..*..*..*1.txt.html URI to read the 1.txt file.

CWE: CWE-22 Published: 2018-12-30T21:29:00.597
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 4.9 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags