CVE-2018-7665: Malicious File Upload
An issue was discovered in ClipBucket before 4.0.0 Release 4902. A malicious file can be uploaded via the name parameter to actions/beatsuploader.php or actions/photouploader.php, or the coverPhoto parameter to editaccount.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ClipBucketto a version that resolves this vulnerability.Fixed in 4.0.0 Release 4902 - Configuration
Update ClipBucket to address the upload parameter vulnerability (name parameter in actions/beats_uploader.php and actions/photo_uploader.php; coverPhoto parameter in edit_account.php).
ClipBucket Input handling for upload parameters (name, coverPhoto) = Sanitize/validate upload-related parameters to prevent malicious file uploads via name parameter (actions/beats_uploader.php, actions/photo_uploader.php) and coverPhoto parameter (edit_account.php)
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7665?
CVE-2018-7665 is considered a high severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2018-7665?
To fix CVE-2018-7665, upgrade ClipBucket to version 4.0.0 Release 4903 or later.
What are the consequences of CVE-2018-7665?
Exploitation of CVE-2018-7665 allows attackers to upload malicious files, leading to possible remote code execution.
What versions of ClipBucket are affected by CVE-2018-7665?
CVE-2018-7665 affects ClipBucket versions prior to 4.0.0 Release 4902.
Where can I find more details about CVE-2018-7665?
More details about CVE-2018-7665 can be found in various security advisories and vulnerability databases.