Lucene search

[email protected]NVD:CVE-2022-36197

HistoryAug 03, 2022 - 1:15 a.m.

CVE-2022-36197

2022-08-0301:15:07

CWE-79

[email protected]

web.nvd.nist.gov

bigtree cms

arbitrary file upload

pdf

vulnerability

execute code

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.4%

JSON

BigTree CMS 4.4.16 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted PDF file.

Affected configurations

Nvd

Node

bigtreecmsbigtree_cmsMatch4.4.16

VendorProductVersionCPE
bigtreecmsbigtree_cms4.4.16cpe:2.3:a:bigtreecms:bigtree_cms:4.4.16:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bigtreecms	bigtree_cms	4.4.16	cpe:2.3:a:bigtreecms:bigtree_cms:4.4.16:::::::*

References

github.com/bigtreecms/BigTree-CMS/issues/392