CVEvulnerability

CVE-2018-10521

2.7 LOW Published 2018-04-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-04-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
2.7 LOW — CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:N/A:P
Weaknesses
CWE-434

Description

In CMS Made Simple (CMSMS) through 2.2.7, the "file move" operation in the admin dashboard contains an arbitrary file movement vulnerability that can cause DoS, exploitable by an admin user, because config.php can be moved into an incorrect directory.

Affected configurations

• cmsmadesimple cms made simple (<= 2.2.7)

Related

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References