GitHub Advisoryadvisory · Packagist

GHSA-4pww-fqgh-36hj Unrestricted Upload of File with Dangerous Type in Croogo

HIGH Published 2022-03-11 Modified 2022-03-28 Official page ↗
Aliases
CVE-2021-44673
Ecosystem
Packagist
Packages
croogo/croogo
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2022-03-28

Affected packages

• Packagist croogo/croogo: <= 3.0.2 (no fix yet)

Description

A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2 via admin/file-manager/attachments, which lets a malicious user upload a web shell script.

Related

Alias · CVE (1)

  • CVE-2021-44673 A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a… vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References