CVE-2017-5480 - Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .

Back Back to CVE browser

HIGH

Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .

Published Jan 15, 2017

8.1

HIGH

CVSS 3.0

EPSS 2.46%

Description

Directory traversal vulnerability in inc/files/files.ctrl.php in b2evolution through 6.8.3 allows remote authenticated users to read or delete arbitrary files by leveraging back-office access to provide a .. (dot dot) in the fm_selected array parameter.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (3)

http://www.securityfocus.com/bid/95454
vdb-entryx_refsource_BID
https://github.com/b2evolution/b2evolution/commit/26841d9c81f27ad23b2f6e4bd5eaec7f2f58dfe0
x_refsource_CONFIRM
https://github.com/b2evolution/b2evolution/issues/35
x_refsource_CONFIRM

Link	Providers	Tags
http://www.securityfocus.com/bid/95454		vdb-entryx_refsource_BID
https://github.com/b2evolution/b2evolution/commit/26841d9c81f27ad23b2f6e4bd5eaec7f2f58dfe0		x_refsource_CONFIRM
https://github.com/b2evolution/b2evolution/issues/35		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 15, 2017

Updated Aug 5, 2024

Reserved Jan 14, 2017

Link CVE-2017-5480

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-5480

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-5480