CVE-2022-23043

2022-02-2218:21:02

Fluid Attacks

www.cve.org

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.7%

JSON

Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new ‘File/MIME Types’ using the ‘.phar’ extension. Then an attacker can upload a malicious file, intercept the request and change the extension to ‘.phar’ in order to run commands on the server.

CNA Affected

[
  {
    "product": "Zenario CMS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "9.2"
      }
    ]
  }
]