CVE-2022-23043
CVE-2022-23043
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.
CVSS 7.2 · Alta · EPSS 1,5% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
zenario cms
- Versiones
- 9.2: Afectada
Sin corrección publicada
tribalsystems/zenario Packagist
- Versiones
- 7.5.40440
- 7.5.41006
- 7.5.41499
- 7.5.41633
- 7.5.42085
- 7.5.42990
- 7.5.47180
- 7.6.41504
- 7.6.41633
- 7.6.42085
- 7.6.42990
- 7.6.47180
- 7.7.42682
- 7.7.42963
- 7.7.42990
- 7.7.44223
- 7.7.47180
- 7.7.47369
- 7.7.48583
- 8.0.44237
- 8.0.44273
- 8.0.44294
- 8.0.44521
- 8.0.45032
- 8.0.45250
- 8.0.45529
- 8.0.47180
- 8.0.48583
- 8.1.45530
- 8.1.45698
- 8.1.46089
- 8.1.46433
- 8.1.46615
- 8.1.47180
- 8.1.47369
- 8.1.48583
- 8.2.46436
- 8.2.46614
- 8.2.47180
- 8.2.47369
- 8.2.47992
- 8.2.48583
- 8.3.47997
- 8.3.48583
- 8.3.50564
- 8.4.50565
- 8.4.51340
- 8.5.50567
- 8.5.50837
- 8.5.51340
- 8.6.51342
- 8.7
- 8.8
- 8.8.53370
- 8.8.53725
- 8.8.54063
- 8.9.54063
- 8.9.54149
- 8.9.54153
- 8.9.55141
- 9.0.54156
- 9.0.55141
- 9.0.57473
- 9.1.55143
- 9.1.55510
- 9.1.55619
- 9.1.57473
- 9.2
- Intervalos de versiones afectados
- ECOSYSTEM: < 9.2.55826
Actualiza a 9.2.55826