CVE-2024-30162: High severity Invision Community Invision Community vulnerability
Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\admin\editor\toolbar::addPlugin() method. This method handles uploaded ZIP files that are extracted into the applications/core/interface/ckeditor/ckeditor/plugins/ directory without properly verifying their content. This can be exploited by admin users (with the toolbarmanage permission) to write arbitrary PHP files into that directory, leading to execution of arbitrary PHP code in the context of the web server user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30162?
CVE-2024-30162 is categorized as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-30162?
To fix CVE-2024-30162, upgrade Invision Community to version 4.7.17 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2024-30162?
CVE-2024-30162 is a remote code execution vulnerability that affects the Invision Community platform.
What can attackers do exploiting CVE-2024-30162?
An attacker exploiting CVE-2024-30162 can execute arbitrary code on the affected server by uploading specially crafted ZIP files.
Which versions of Invision Community are affected by CVE-2024-30162?
CVE-2024-30162 affects Invision Community versions up to and including 4.7.16.