Lucene search
HistoryJun 13, 2008 - 6:41 p.m.
CVE-2008-2686
cve-2008-2686
flux cms
webinc
bxe
loadsave.php
arbitrary code execution
nvd
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.8 High
AI Score
Confidence
High
0.032 Low
EPSS
Percentile
91.3%
webinc/bxe/scripts/loadsave.php in Flux CMS 1.5.0 and earlier allows remote attackers to execute arbitrary code by overwriting a PHP file in webinc/bxe/scripts/ via a filename in the XML parameter and PHP sequences in the request body, then making a direct request for this filename.
Affected configurations
Node
flux_cmsflux_cmsRange≤1.50
ORflux_cmsflux_cmsMatch1.2
ORflux_cmsflux_cmsMatch1.3
ORflux_cmsflux_cmsMatch1.4
ORflux_cmsflux_cmsMatch1.31
Related
prion
prion
Design/Logic Flaw
2008-06-13 18:41:00
cvelist
cvelist
CVE-2008-2686
2008-06-13 18:00:00
nvd
nvd
CVE-2008-2686
2008-06-13 18:41:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
7.8 High
AI Score
Confidence
High
0.032 Low
EPSS
Percentile
91.3%
Related for CVE-2008-2686