Description

The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ..\/ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.

Remediation

References

CVE-2017-5539

Related Vulnerabilities

Internet Information Services Other Vulnerability (CVE-2003-0226)

WordPress Plugin WP User-Custom Registration Forms, Login and User Profile Multiple Vulnerabilities (7.0)

MySQL CVE-2021-2087 Vulnerability (CVE-2021-2087)

PrestaShop Improper Restriction of Rendered UI Layers or Frames Vulnerability (CVE-2018-7491)

WordPress Plugin Advanced Classifieds & Directory Pro Local File Inclusion (3.1.3)

Severity

Critical

Classification

CVE-2017-5539 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Tags

Missing Update Known Vulnerabilities