Lucene search

[email protected]NVD:CVE-2016-9835

HistoryDec 05, 2016 - 8:59 a.m.

CVE-2016-9835

2016-12-0508:59:02

CWE-77

CWE-284

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

Directory traversal vulnerability in file “jcss.php” in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.

Affected configurations

NVD

Node

zikulazikula_application_frameworkMatch1.3.0

zikulazikula_application_frameworkMatch1.3.1

zikulazikula_application_frameworkMatch1.3.2

zikulazikula_application_frameworkMatch1.3.3

zikulazikula_application_frameworkMatch1.3.4

zikulazikula_application_frameworkMatch1.3.5

zikulazikula_application_frameworkMatch1.3.6

zikulazikula_application_frameworkMatch1.3.7

zikulazikula_application_frameworkMatch1.3.8

zikulazikula_application_frameworkMatch1.3.9

zikulazikula_application_frameworkMatch1.3.10

zikulazikula_application_frameworkMatch1.3.10rc1

zikulazikula_application_frameworkMatch1.4.0

zikulazikula_application_frameworkMatch1.4.0rc1

zikulazikula_application_frameworkMatch1.4.0rc2

zikulazikula_application_frameworkMatch1.4.0rc3

zikulazikula_application_frameworkMatch1.4.0rc4

zikulazikula_application_frameworkMatch1.4.0rc5

zikulazikula_application_frameworkMatch1.4.1

zikulazikula_application_frameworkMatch1.4.2

zikulazikula_application_frameworkMatch1.4.3

zikulazikula_application_frameworkMatch1.4.3rc1

zikulazikula_application_frameworkMatch1.4.3rc2

zikulazikula_application_frameworkMatch1.4.3rc3

References

www.securityfocus.com/bid/95005

github.com/zikula/core/blob/1.3/CHANGELOG-1.3.md

github.com/zikula/core/blob/1.4/CHANGELOG-1.4.md

github.com/zikula/core/issues/3237

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for NVD:CVE-2016-9835

cvelist1 openvas1 cve1 prion1