CVE-2022-24977

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe inte...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Références

advisory github.com
advisory nvd.nist.gov
patch github.com
web github.com
web r0.haxors.org