Vulnerability · Published Feb 13, 2022 · Assigned by mitre
CVE-2022-24977
Critical 9.8
In plain English
A critical-severity security flaw in the impresscms/impresscms package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.4% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)6.4%top 6.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | impresscms/impresscms | 1.4.2 | GHSA-389p-fchr-q2mg |
Affected products (as reported)
References
- https://r0.haxors.org/posts?id=8 x_refsource_MISC
- https://github.com/ImpressCMS/impresscms/commit/a66d7bb499faafab803e24833606028fa0ba4261 x_refsource_MISC
- https://github.com/ImpressCMS/impresscms/compare/1.4.1...v1.4.2 x_refsource_MISC