CVE-2018-16344

{"id": "CVE-2018-16344", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-09-02T18:29:00.883", "references": [{"url": "https://github.com/cumtxujiabin/CmsPoc/blob/master/zzcms_8.3_file_del.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/cumtxujiabin/CmsPoc/blob/master/zzcms_8.3_file_del.md", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in zzcms 8.3. It allows remote attackers to delete arbitrary files via directory traversal sequences in the flv parameter. This can be leveraged for database access by deleting install.lock."}, {"lang": "es", "value": "Se ha descubierto un problema en zzcms 8.3. Permite que los atacantes remotos eliminen archivos arbitrarios mediante secuencias de salto de directorio en el par\u00e1metro flv. Esto se puede aprovechar para conseguir acceso a bases de datos mediante la eliminaci\u00f3n de install.lock."}], "lastModified": "2024-11-21T03:52:33.953", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zzcms:zzcms:8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C182DD1C-441F-4707-8BB6-67630FC09B03"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}