[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAEDdjHeGavmJFGhHTPqX0MXMoYornLRpBiixKWAA_yoyB-3rqA@mail.gmail.com>
Date: Mon, 3 Feb 2014 00:19:47 +0000
From: Pedro Ribeiro <pedrib@...il.com>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com,
ImpressCMS Security <security@...resscms.org>, Steve Kenow <skenow@...resscms.org>
Subject: Re: CVE request: impressCMS 1.3.5 arbitrary file deletion and XSS
On 31 January 2014 15:14, <cve-assign@...re.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>> https://github.com/pedrib/PoC/blob/master/ImpressCMS/impresscms-1.3.5.txt
>> ImpressCMS 1.3.5 vulnerabilities
>
>> Vulnerability: Deletion of arbitrary files in the system
>> File(line): /impresscms/htdocs/libraries/image-editor/image-edit.php(62)
>> if (file_exists ( $image_path )) {
>> @unlink ( $image_path );
>> 192.168.56.101/impresscms/htdocs/libraries/image-editor/image-edit.php?op=cancel&image_path=/path
>
> Use CVE-2014-1836 for this deletion issue.
>
> CVE assignment for the XSS issues requires that there is a possible
> configuration in which the issues are exploitable. (If they are not
> exploitable, but the vendor made applicable code changes anyway for
> security hardening, a CVE assignment won't be made.)
>
> - --
> CVE assignment team, MITRE CVE Numbering Authority
> M/S M300
> 202 Burlington Road, Bedford, MA 01730 USA
> [ PGP key available through http://cve.mitre.org/cve/request_id.html ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (SunOS)
>
> iQEcBAEBAgAGBQJS67y5AAoJEKllVAevmvmszHUH/21NY3Vv27aVdUxIxy9H7gV5
> f/nTg+D/exE7PX1Z7WHnt+cQNDCPDcMUZJcNTa9ZWHHrBNHOGjbKHDczPmPhcxs/
> WhDlgrWOgJJ/DXWg49MSXOWPHD3NlBzvrd/XthjncgQbj0xZ4wHlQ/8JNKklppHU
> v8OH1KoaVeX2SwDIIpe/kZWYatxRKWZ2m8I7JrPKmCkJVx1ksoqW3Q1p5s2PXmoP
> FW5FAiGMlu1kansIQxiJXIMswZbzULD76l2dp4cSYls9EYMrptrrbxlWD8zqwPHA
> jou3xOS8UoDDxUB7hil/lR4vXwpF5O/PIGqmAd3Ie4vPCSnUunNNnYprmnGwafU=
> =YGh+
> -----END PGP SIGNATURE-----
Thank you.
If anyone cares, the advisory is now at
https://github.com/pedrib/PoC/blob/master/impresscms-1.3.5.txt.
Regards,
Pedro
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
