CVE-2014-2302 The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org.
CriticalCVSS 9.8
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webedition cms | < 6.2.7.0 | 6.2.7.0 |
| webedition cms | >= 6.3.0, < 6.3.8 | 6.3.8 |
| webedition cms | = 6.2.7.0-s1 | No fix listed |
| webedition cms | = 6.3.8-s1 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20140528 [RT-SA-2014-004] Remote Command Execution in webEdition CMS Installer Script exploit mailing-list third-party-advisory
- 20140528 [RT-SA-2014-004] Remote Command Execution in webEdition CMS Installer Script exploit mailing-list third-party-advisory vdb-entry
- 67692 third-party-advisory vdb-entry
- www.redteam-pentesting.de exploit third-party-advisory