CVE-2015-7684 Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessin...
HighCVSS 9.0
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| glpi-project glpi | <= 0.85.2 | No fix listed |
References
- 20150217 [CVE-REQUEST] Multiple vulnerabilities on GLPI mailing-list
- www.glpi-project.org vendor-advisory
- forge.glpi-project.org