Arbitrary File Upload Vulnerability in InvoicePlane by InvoicePlane
CVE-2017-1000238

8.8HIGH

Key Information:

Vendor

Invoiceplane

Status
Invoiceplane
Vendor
CVE Published:
17 November 2017

What is CVE-2017-1000238?

The vulnerability in InvoicePlane version 1.4.10 allows authenticated users to upload arbitrary files to the webserver. This misconfiguration enables attackers to leverage this flaw to upload malicious scripts, potentially leading to severe security breaches and compromise of the entire webserver.

References

https://www.sec-consult.com/fxdata/seccons/prod/temedia/a...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.