GitHub Advisoryadvisory · Packagist

GHSA-pcf7-5974-vjh4 Elefant CMS Improper Input Validation

CRITICAL Published 2022-05-14 Modified 2023-07-25 Official page ↗
Aliases
CVE-2018-15601
Ecosystem
Packagist
Packages
elefant/cms
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-07-25

Affected packages

• Packagist elefant/cms: < 2.0.4 → fixed in 2.0.4

Description

`apps/filemanager/handlers/upload/drop.php` in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.

Related

Alias · CVE (1)

  • CVE-2018-15601 apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files"… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References