This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-14857 →

DEBIAN-CVE-2018-14857

Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server thro...

Original description

The description as published by the source.

Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged user to gain access to the server via a template file containing PHP code, because file extensions other than .html are permitted.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ocsinventory-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8+dfsg1-1"}]}]

References

advisory security-tracker.debian.org