CVE-2017-5539 The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ../ to bypass the filter rule. Then, this attacker can exploit thi...
CriticalCVSS 9.1
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The patch for directory traversal (CVE-2017-5480) in b2evolution version 6.8.4-stable has a bypass vulnerability. An attacker can use ../ to bypass the filter rule. Then, this attacker can exploit this vulnerability to delete or read any files on the server. It can also be used to determine whether a file exists.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b2evolution | = 6.8.4 | No fix listed |
References
- b2evolution.net patch vendor-advisory
- 95700 third-party-advisory vdb-entry
- github.com issue-tracking patch third-party-advisory
- github.com issue-tracking patch third-party-advisory