CVE-2017-8868

2017-05-1005:29:00

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.9%

JSON

acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.

CPENameOperatorVersion
flatcore-cmseq1.4beta3
flatcore-cmseqRC4v2
flatcore-cmseq1.4beta4
flatcore-cmseq1.4.5
flatcore-cmseq1.4beta2
flatcore-cmseqReleaseCandidate3
flatcore-cmseqReleaseCandidate4
flatcore-cmseq1.0
flatcore-cmseqVersion1.0
flatcore-cmseq1.3

Name	Operator	Version
flatcore-cms	eq	1.4beta3
flatcore-cms	eq	RC4v2
flatcore-cms	eq	1.4beta4
flatcore-cms	eq	1.4.5
flatcore-cms	eq	1.4beta2
flatcore-cms	eq	ReleaseCandidate3
flatcore-cms	eq	ReleaseCandidate4
flatcore-cms	eq	1.0
flatcore-cms	eq	Version1.0
flatcore-cms	eq	1.3

Rows per page:

1-10 of 181

References

github.com/flatCore/flatCore-CMS/issues/30