CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE
CriticalCVSS 9.3
EPSS 4.3%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| umbraco CMS | < 4.7.1 | 4.7.1 |
| umbraco cms | < 4.7.1 | 4.7.1 |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- web.archive.org exploit patch technical-description
- github.com product
- web.archive.org patch third-party-advisory vendor-advisory
- www.vulncheck.com third-party-advisory