Remote Code Execution Vulnerability in Pluck CMS by Ross Marks
CVE-2014-8708

9.8CRITICAL

Key Information:

Vendor

Pluck-cms

Status
Pluck
Vendor
CVE Published:
17 March 2017

What is CVE-2014-8708?

Pluck CMS version 4.7.2 contains a vulnerability that permits remote attackers to execute arbitrary code through the blog form feature. This security flaw exposes users to significant risks, as it allows attackers to manipulate the application and potentially cause damage or steal sensitive information. It is crucial for users of this CMS to apply appropriate security measures and stay informed about available patches.

References

http://rossmarks.uk/whitepapers/pluck_cms_4.7.txt
x_refsource_MISC
http://rossmarks.uk/portfolio.php
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.