|
[Japanese]
|
JVNDB-2017-000036
|
WBCE CMS vulnerable to directory traversal
|
|
WBCE CMS provided by WBCE Team is an open-source Contents Management System (CMS). WBCE CMS contains a directory traversal vulnerability (CWE-22).
ASAI Ken reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
|
|
CVSS V3 Severity:
Base Metrics 5.8 (Medium) [IPA Score]
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Changed
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
CVSS V2 Severity:
Base Metrics 5.0 (Medium) [IPA Score]
- Access Vector: Network
- Access Complexity: Low
- Authentication: None
- Confidentiality Impact: Partial
- Integrity Impact: None
- Availability Impact: None
|
|
|
WBCE Team
- WBCE CMS 1.1.10 and earlier
|
|
|
An arbitrary local file on the server may be accessed by a remote attacker.
An arbitrary local file outside of WBCE CMS may be deleted by an administrator of WBCE CMS.
|
|
[Update the software]
Update to the latest version according to the information provided by the developer.
[Apply the Patch]
The patch for WBCE CMS 1.1.3 to 1.1.10 is available.
Apply the patch according to the information provided by the developer.
|
|
WBCE Team
|
|
- Path Traversal(CWE-22) [IPA Evaluation]
|
|
- CVE-2017-2119
|
|
- JVN : JVN#73083905
- National Vulnerability Database (NVD) : CVE-2017-2119
|
|
- [2017/02/28]
Web page was published
[2017/06/01]
References : Content was added
|
