medium4.9Public exploit code
CVE-2015-4425
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary f…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Pimcore CMS Build 3450 - Directory Traversal2015-07-14 · webapps · xml
Impact
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pimcore | Pimcore | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2015/Jul/57
- https://github.com/pimcore/pimcore/commit/4f2a95f877d406a054f9f2253475fe58c76aa03d
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-4425/
- http://seclists.org/fulldisclosure/2015/Jul/57
- https://github.com/pimcore/pimcore/commit/4f2a95f877d406a054f9f2253475fe58c76aa03d
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-4425/