Lucene search

MitreCVE-2012-1468

HistorySep 06, 2012 - 9:55 p.m.

CVE-2012-1468

2012-09-0621:55:01

mitre

web.nvd.nist.gov

cve-2012-1468

open journal systems

vulnerability

remote code execution

security

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

7.3

Confidence

Low

EPSS

0.017

Percentile

88.1%

JSON

Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not “.php”, then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions.

Affected configurations

Nvd

Node

pkpopen_journal_systemsRange≤2.3.6

VendorProductVersionCPE
pkpopen_journal_systems*cpe:2.3:a:pkp:open_journal_systems:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pkp	open_journal_systems	*	cpe:2.3:a:pkp:open_journal_systems::::::::

References

pkp.sfu.ca/ojs/RELEASE-2.3.7

pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431

www.htbridge.com/advisory/HTB23079

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

7.3

Confidence

Low

EPSS

0.017

Percentile

88.1%

JSON

Related for CVE-2012-1468