PT-2017-12141

CVE-2017-11630

·

Published

2017-07-26

·

Updated

2017-07-31

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7
Description The issue allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request to the /dapur/apps/app config/controller/backuper.php endpoint.
Recommendations For Fiyo CMS version 2.0.7, restrict access to the backuper.php file to minimize the risk of exploitation. Avoid using the file parameter in the affected endpoint until the issue is resolved.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2017-11630
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com