Unrestricted File Upload

2022-10-1808:38:38

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

file upload

theme installer

arbitrary code execution

vulnerability

software

0.081 Low

EPSS

Percentile

94.3%

JSON

backdrop is vulnerable to unrestricted file upload. The vulnerability exists in the themes module which allows an attacker to upload a malicious file as a theme for the theme installer, which can execute arbitrary code.

CPENameOperatorVersion
backdrop/backdrople1.22.2
backdrop/backdrople1.22.2

CPE	Name	Operator	Version
	backdrop/backdrop	le	1.22.2
	backdrop/backdrop	le	1.22.2

References

github.com/advisories/GHSA-33c9-rppf-m7fq

grimthereaperteam.medium.com/backdrop-cms-1-22-0-unrestricted-file-upload-themes-ad42a599561c

0.081 Low

EPSS

Percentile

94.3%

JSON

Related for VERACODE:37589