Lucene search
HistorySep 22, 2015 - 3:59 p.m.
CVE-2015-7309
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.5 High
AI Score
Confidence
High
0.449 Medium
EPSS
Percentile
97.4%
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Affected configurations
Node
boltcmsboltRange≤2.2.0
References
Related
cve
cve
CVE-2015-7309
2022-10-03 16:15:57
veracode
veracode
Arbitrary Code Execution
2017-07-29 01:50:51
prion
prion
Code injection
2015-09-22 15:59:00
cvelist
cvelist
CVE-2015-7309
2022-10-03 16:15:57
cbl_mariner
cbl_mariner
CVE-2015-7309 affecting package bolt 0.9.2-2
2024-07-03 03:08:37
rosalinux
rosalinux
Advisory ROSA-SA-2021-1809
2021-07-02 16:34:28
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.5 High
AI Score
Confidence
High
0.449 Medium
EPSS
Percentile
97.4%
Related for NVD:CVE-2015-7309