CVE-2018-12914 A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, t...
CriticalCVSS 9.8
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation, the attacker can execute arbitrary code by visiting a .jsp URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| publiccms | = 4.0.20180210 | No fix listed |
References
- github.com exploit third-party-advisory