CVE-2012-10054: fallo crítico en Umbraco CMS
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
63Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 9.3epss 4.3%
de la publicación al armael mismo día
Publicada en NVD13 ago
metasploit28 jun
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Umbraco · CMSPoCs públicas encontradas — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rbno verificadocve_referenceweb.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.htmlno verificadocve_referencewww.exploit-db.com/exploits/19671no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Umbraco CMS
En el mismo producto, de las más peligrosas a las menos.
Referencias
https://github.com/umbraco/Umbraco-CMShttps://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rbhttps://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.htmlhttps://www.exploit-db.com/exploits/19671https://www.vulncheck.com/advisories/umbraco-cms-rce