GitHub Advisoryadvisory · Packagist

GHSA-33c9-rppf-m7fq Backdrop CMS Unrestricted File Upload vulnerability

HIGH Published 2022-10-07 Modified 2023-01-18 Official page ↗

Aliases: CVE-2022-42092
Ecosystem: Packagist
Packages: backdrop/backdrop
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-434
Reviewed: 2023-01-18

Affected packages

• Packagist backdrop/backdrop: <= 1.22.0 (no fix yet)

Description

Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via `themes` that allows attackers to achieve Remote Code Execution.

Related

Alias · CVE (1)

CVE-2022-42092 Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. vulnerability

Weakness · CWE (1)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References