CVE-2012-10054: critical vulnerability in Umbraco CMS
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
63Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.3epss 4.3%
from disclosure to weaponsame day
Published on NVDAug 13
metasploitJun 28
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Umbraco · CMSpublic PoCs found — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rbunverifiedcve_referenceweb.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.htmlunverifiedcve_referencewww.exploit-db.com/exploits/19671unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Umbraco CMS
In the same product, most dangerous first.
References
https://github.com/umbraco/Umbraco-CMShttps://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rbhttps://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.htmlhttps://www.exploit-db.com/exploits/19671https://www.vulncheck.com/advisories/umbraco-cms-rce