CVE-2017-13670: Medium severity blackcat cms vulnerability
Published Aug 31, 2017
·Updated
In BlackCat CMS 1.2, remote authenticated users can upload any file via the media upload function in backend/media/ajaxupload.php, as demonstrated by a ZIP archive that contains a .php file.
Affected Software
1 affected component
Blackcat-cms Blackcat Cms=1.2
Event History
Aug 31, 2017
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-13670?
CVE-2017-13670 is considered a high severity vulnerability due to the ability of remote authenticated users to upload arbitrary files.
2
How do I fix CVE-2017-13670?
To fix CVE-2017-13670, update BlackCat CMS to a newer version that addresses the file upload vulnerability.
3
Who is affected by CVE-2017-13670?
Users of BlackCat CMS version 1.2 are affected by CVE-2017-13670 due to its insecure media upload feature.
4
What type of attacks can CVE-2017-13670 facilitate?
CVE-2017-13670 can facilitate remote code execution attacks through the upload of malicious PHP files.
5
Is CVE-2017-13670 exploitable without authentication?
No, CVE-2017-13670 requires authentication, as it affects remote authenticated user actions.