CVE-2018-16141: Path Traversal
Published Aug 30, 2018
·Updated
ThinkCMF X2.2.3 has an arbitrary file deletion vulnerability in doavatar in \application\User\Controller\ProfileController.class.php via an imgurl parameter with a ..\ sequence. A member user can delete any file on a Windows server.
Affected Software
1 affected component
ThinkCMF Thinkcmfx=x2.2.3
Event History
Aug 30, 2018
CVE Published
via MITRE·05:00 AM
Data Sourced
via MITRE·05:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-16141?
CVE-2018-16141 is classified as a critical vulnerability due to its potential for arbitrary file deletion on Windows servers.
2
Who is affected by CVE-2018-16141?
CVE-2018-16141 affects users of ThinkCMF version x2.2.3.
3
How do I fix CVE-2018-16141?
To fix CVE-2018-16141, upgrade ThinkCMF to a version higher than x2.2.3 that has patched this vulnerability.
4
What kind of exploitation can occur with CVE-2018-16141?
Exploitation of CVE-2018-16141 can allow a member user to delete any file on the server using crafted requests.
5
What is the specific component affected by CVE-2018-16141?
CVE-2018-16141 specifically affects the do_avatar method in ProfileController.class.php in ThinkCMF.