Code injection

2015-06-1514:59:00

PRIOn knowledge base

www.prio-n.com

7.7 High

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.7%

JSON

The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the “Save file information” permission to execute arbitrary code via a crafted filename.

CPENameOperatorVersion
serviceseq7.120.30
serviceseq7.120.36
serviceseq7.120.311
serviceseq7.120.37
serviceseq7.120.33
serviceseq7.120.31
serviceseq7.120.39
serviceseq7.120.34
serviceseq7.120.310
serviceseq7.120.35

Name	Operator	Version
services	eq	7.120.30
services	eq	7.120.36
services	eq	7.120.311
services	eq	7.120.37
services	eq	7.120.33
services	eq	7.120.31
services	eq	7.120.39
services	eq	7.120.34
services	eq	7.120.310
services	eq	7.120.35