CVEvulnerability

CVE-2015-7904

6.5 MEDIUM Published 2015-10-28 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2015-10-28
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 2.0 ([email protected]): 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P

Description

Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.

Affected configurations

• infinite automation systems mango automation 2.5.0 • infinite automation systems mango automation 2.5.5 • infinite automation systems mango automation 2.6.0

References

https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02 Patch, Third Party Advisory, US Government Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02 Patch, Third Party Advisory, US Government Resource