GitHub Advisoryadvisory · Packagist

GHSA-389p-fchr-q2mg Path Traversal in ImpressCMS

CRITICAL Published 2022-02-15 Modified 2022-02-25 Official page ↗
Aliases
CVE-2022-24977
Ecosystem
Packagist
Packages
impresscms/impresscms
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2022-02-25

Affected packages

• Packagist impresscms/impresscms: < 1.4.2 → fixed in 1.4.2

Description

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.

Related

Alias · CVE (1)

  • CVE-2022-24977 ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References