CVE-2017-1000119

high · 7.2

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

7.2

CVSS

61.3%

EPSS (exploit prob.)

99th

EPSS percentile

2017-10-05

Published

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
octobercms	october	1.0.412

Check a specific version with /api/v1/cve/match.

References

http://octobercms.com/support/article/rn-8
http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html
http://octobercms.com/support/article/rn-8
http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-1000119