Lucene search
PRIOn knowledge basePRION:CVE-2021-44911HistoryFeb 09, 2022 - 4:15 p.m.
Unrestricted file upload
2022-02-0916:15:00
PRIOn knowledge base
www.prio-n.com
2
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities.
| CPE | Name | Operator | Version |
|---|---|---|---|
| xpressengine | lt | 1.11.6 |
Related
nvd
nvd
CVE-2021-44911
2022-02-09 16:15:14
cve
cve
CVE-2021-44911
2022-02-09 16:15:14
osv
osv
CVE-2021-44911
2022-02-09 16:15:14
cvelist
cvelist
CVE-2021-44911
2022-02-09 15:40:49