Description

Directory traversal in /connectors/index.php in MODX Revolution before 2.5.2-pl allows remote attackers to perform local file inclusion/traversal/manipulation via a crafted dir parameter, related to browser/directory/remove.

Remediation

References

CVE-2016-10038

Related Vulnerabilities

PrestaShop Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2018-19126)

Oracle Database Server CVE-2020-2517 Vulnerability (CVE-2020-2517)

PHP Other Vulnerability (CVE-2003-0097)

XWiki Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-32621)

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-28979)

Severity

High

Classification

CVE-2016-10038 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities