CVE-2018-1000882 - WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read

Back Back to CVE browser

HIGH

WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read

Published Dec 20, 2018

7.5

HIGH

CVSS 3.0

EPSS 2.38%

Description

WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (4)

http://bugs.webidsupport.com/view.php?id=646
x_refsource_MISCIssue TrackingRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2059
Advisory
https://github.com/renlok/WeBid/commit/256a5f9d3eafbc477dcf77c7682446cc4b449c7f
x_refsource_MISCPatch
https://telekomsecurity.github.io/assets/advisories/20181108_WeBid_Multiple_Vulnerabilities.txt
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
http://bugs.webidsupport.com/view.php?id=646		x_refsource_MISCIssue TrackingRelease NotesVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-2059		Advisory
https://github.com/renlok/WeBid/commit/256a5f9d3eafbc477dcf77c7682446cc4b449c7f		x_refsource_MISCPatch
https://telekomsecurity.github.io/assets/advisories/20181108_WeBid_Multiple_Vulnerabilities.txt		x_refsource_MISCExploitThird Party Advisory