CVE-2012-10054: falha crítica em Umbraco CMS
Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
63Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 9.3epss 4.3%
da publicação à armano mesmo dia
Publicada no NVD13 de ago.
metasploit28 de jun.
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
Umbraco · CMSPoCs públicas encontradas — 3
cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rbnão verificadocve_referenceweb.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.htmlnão verificadocve_referencewww.exploit-db.com/exploits/19671não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Umbraco CMS
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/umbraco/Umbraco-CMShttps://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rbhttps://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.htmlhttps://www.exploit-db.com/exploits/19671https://www.vulncheck.com/advisories/umbraco-cms-rce