CVE-2018-9206 Unrestricted Upload of File with Dangerous Type in blueimp-file-upload
CriticalCVSS 9.8
EPSS 97.3%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm blueimp-file-upload(npm) | <= 9.22.0 | No fix listed |
| debian/libjs-jquery-file-upload(Debian:12) | < 9.25.0-1 | 9.25.0-1 |
| debian/libjs-jquery-file-upload(Debian:14) | < 9.25.0-1 | 9.25.0-1 |
| debian/libjs-jquery-file-upload(Debian:13) | < 9.25.0-1 | 9.25.0-1 |
| wordpress tajer(WordPress) | <= 1.0.5 | No fix listed |
| Blueimp jQuery-File-Upload | <= 9.22.0 | No fix listed |
| jquery file upload project jquery file upload | <= 9.22.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- wpvulndb.com exploit third-party-advisory
- 45790 exploit third-party-advisory vdb-entry
- 46182 exploit third-party-advisory vdb-entry
- www.oracle.com patch third-party-advisory
- 105679 third-party-advisory vdb-entry
- 106629 third-party-advisory vdb-entry
- www.vapidlabs.com exploit third-party-advisory
- Debian Security Tracker CVE-2018-9206 vendor-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org
- github.com
- github.com