CVE-2022-42458

2022-12-0700:00:00

jpcert

www.cve.org

authentication bypass

bingo!cms

remote unauthenticated attacker

arbitrary file upload

arbitrary script execution

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.3%

JSON

Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to upload an arbitrary file. As a result, an arbitrary script may be executed and/or a file may be altered.

CNA Affected

[
  {
    "vendor": "Shift Tech Inc.",
    "product": "bingo!CMS",
    "versions": [
      {
        "version": "version1.7.4.1 and earlier",
        "status": "affected"
      }
    ]
  }
]