CVE-2018-1000550 - The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem

Back Back to CVE browser

CRITICAL

The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem

Published Jun 26, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 2.58%

Description

The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This vulnerability appears to have been fixed in 6.2.32.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1939
Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00033.html
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://sympa-community.github.io/security/2018-001.html
x_refsource_MISCPatchVendor Advisory
https://usn.ubuntu.com/4442-1/
vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4285
vendor-advisoryx_refsource_DEBIAN

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1939		Advisory
https://lists.debian.org/debian-lts-announce/2018/07/msg00033.html		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
https://sympa-community.github.io/security/2018-001.html		x_refsource_MISCPatchVendor Advisory
https://usn.ubuntu.com/4442-1/		vendor-advisoryx_refsource_UBUNTU
https://www.debian.org/security/2018/dsa-4285		vendor-advisoryx_refsource_DEBIAN