A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.
Products Affected
| Vendor | Product | Version |
|---|---|---|
| phillipsdata | blesta | * |
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| cve@mitre.org | 7.5 | HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | 1.6 | 5.9 |
Products Affected
| Vendor | Product | Version |
|---|---|---|
| phillipsdata | blesta | * |
Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| cve@mitre.org | 7.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | 1.2 | 5.9 |
Products Affected
| Vendor | Product | Version |
|---|---|---|
| phillipsdata | blesta | * |
Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| cve@mitre.org | 4.7 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N | 1.6 | 2.7 |
Products Affected
| Vendor | Product | Version |
|---|---|---|
| phillipsdata | blesta | * |