Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2018-14857 →

DEBIAN-CVE-2018-14857

Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server thro...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged user to gain access to the server via a template file containing PHP code, because file extensions other than .html are permitted.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 ocsinventory-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8+dfsg1-1"}]}]

Références

advisory security-tracker.debian.org