CVE-2012-10054: Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-10054?
CVE-2012-10054 has a high severity rating due to its potential for unauthenticated remote code execution.
How do I fix CVE-2012-10054?
To fix CVE-2012-10054, upgrade Umbraco CMS to version 4.7.1 or later, which addresses the vulnerability.
What is the impact of CVE-2012-10054 on my Umbraco CMS?
The impact of CVE-2012-10054 includes the risk of unauthorized remote code execution, potentially leading to data breaches or full system compromise.
What versions of Umbraco CMS are affected by CVE-2012-10054?
CVE-2012-10054 affects Umbraco CMS versions prior to 4.7.1.
Is authentication required to exploit CVE-2012-10054?
No, CVE-2012-10054 can be exploited without any authentication, making it particularly dangerous.