CVE-2015-4393

2015-06-1514:00:00

mitre

www.cve.org

7.2 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.7%

JSON

The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the “Save file information” permission to execute arbitrary code via a crafted filename.

References

www.openwall.com/lists/oss-security/2015/04/25/6

www.securityfocus.com/bid/74365

www.drupal.org/node/2471847

www.drupal.org/node/2471879