QwikSec

Security Database

CVE

CWE

Training

CVE-2016-15017

Published: Jan 10, 2023

Modified: Aug 6, 2024

PUBLISHED

CVSS v3.1

5.5

MEDIUM

Description

A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.

Vendor	Product	Versions
fabarea	media_upload	affected `n/a`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

References

https://vuldb.com/?id.217786

vdb-entry

technical-description

https://vuldb.com/?ctiid.217786

signature

permissions-required

https://github.com/fabarea/media_upload/issues/6

issue-tracking

https://github.com/fabarea/media_upload/commit/b25d42a4981072321c1a363311d8ea2a4ac8763a

patch

https://github.com/fabarea/media_upload/releases/tag/0.9.0

patch

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.