[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201401311514.s0VFEpbC016248@linus.mitre.org>
Date: Fri, 31 Jan 2014 10:14:51 -0500 (EST)
From: cve-assign@...re.org
To: pedrib@...il.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com,
security@...resscms.org, skenow@...resscms.org
Subject: Re: CVE request: impressCMS 1.3.5 arbitrary file deletion and XSS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://github.com/pedrib/PoC/blob/master/ImpressCMS/impresscms-1.3.5.txt
> ImpressCMS 1.3.5 vulnerabilities
> Vulnerability: Deletion of arbitrary files in the system
> File(line): /impresscms/htdocs/libraries/image-editor/image-edit.php(62)
> if (file_exists ( $image_path )) {
> @unlink ( $image_path );
> 192.168.56.101/impresscms/htdocs/libraries/image-editor/image-edit.php?op=cancel&image_path=/path
Use CVE-2014-1836 for this deletion issue.
CVE assignment for the XSS issues requires that there is a possible
configuration in which the issues are exploitable. (If they are not
exploitable, but the vendor made applicable code changes anyway for
security hardening, a CVE assignment won't be made.)
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJS67y5AAoJEKllVAevmvmszHUH/21NY3Vv27aVdUxIxy9H7gV5
f/nTg+D/exE7PX1Z7WHnt+cQNDCPDcMUZJcNTa9ZWHHrBNHOGjbKHDczPmPhcxs/
WhDlgrWOgJJ/DXWg49MSXOWPHD3NlBzvrd/XthjncgQbj0xZ4wHlQ/8JNKklppHU
v8OH1KoaVeX2SwDIIpe/kZWYatxRKWZ2m8I7JrPKmCkJVx1ksoqW3Q1p5s2PXmoP
FW5FAiGMlu1kansIQxiJXIMswZbzULD76l2dp4cSYls9EYMrptrrbxlWD8zqwPHA
jou3xOS8UoDDxUB7hil/lR4vXwpF5O/PIGqmAd3Ie4vPCSnUunNNnYprmnGwafU=
=YGh+
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
