CVE-2016-6255 Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
HighCVSS 7.5
EPSS 27.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian linux | = 8.0 | No fix listed |
| libupnp project libupnp | <= 1.6.20 | No fix listed |
References
- DSA-3736 third-party-advisory vendor-advisory
- [oss-security] 20160718 libupnp write files via POST mailing-list patch third-party-advisory
- [oss-security] 20160720 Re: libupnp write files via POST mailing-list patch third-party-advisory
- 92050 third-party-advisory vdb-entry
- github.com issue-tracking patch third-party-advisory
- GLSA-201701-52 vendor-advisory
- sourceforge.net release-notes third-party-advisory
- twitter.com third-party-advisory
- 40589 exploit
- www.tenable.com