The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html | Exploit Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/45016/ | Exploit Third Party Advisory VDB Entry |
| https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ | Exploit Third Party Advisory |
| http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html | Exploit Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/45016/ | Exploit Third Party Advisory VDB Entry |
| https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 03:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.exploit-db.com/exploits/45016/ - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/ - Exploit, Third Party Advisory |
Information
Published : 2018-07-16 14:29
Updated : 2024-11-21 03:48
NVD link : CVE-2018-13980
Mitre link : CVE-2018-13980
CVE.ORG link : CVE-2018-13980
JSON object : View
Products Affected
zeta-producer
- zeta_producer
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')