PT-2022-19739
CVE-2022-29632
·
تاريخ النشر
2022-05-26
·
تاريخ التحديث
2022-06-08
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Roncoo Education version 9.0.0
Description
The issue is related to an arbitrary file upload vulnerability in the
/course/api/upload/pic component, allowing attackers to execute arbitrary code via a crafted file.Recommendations
For Roncoo Education version 9.0.0, consider disabling the
/course/api/upload/pic component until a patch is available to prevent arbitrary file uploads and subsequent code execution. Restrict access to this component to minimize the risk of exploitation. Avoid using this component for file uploads until the issue is resolved.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾