NVD Vulnerability Detail

CVE-2015-6567

Summary	Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter "filename" properly. Exploitation requires a registered user who has access to upload functionality.
Publication Date	April 15, 2017, 1:59 a.m.
Registration Date	Jan. 26, 2021, 2:54 p.m.
Last Update	Nov. 21, 2024, 11:35 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:wolfcms:wolf_cms::::::::			0.8.3

Related information, measures and tools

No	URL	タグ
1	http://www.websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html	Exploit Technical Description Third Party Advisory
2	http://www.websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html	Exploit Technical Description Third Party Advisory
3	https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa	Patch Third Party Advisory
4	https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa	Patch Third Party Advisory
5	https://github.com/wolfcms/wolfcms/issues/625	Third Party Advisory
6	https://github.com/wolfcms/wolfcms/issues/625	Third Party Advisory
7	https://github.com/wolfcms/wolfcms/releases/tag/0.8.3.1	Release Notes Third Party Advisory
8	https://github.com/wolfcms/wolfcms/releases/tag/0.8.3.1	Release Notes Third Party Advisory
9	https://www.exploit-db.com/exploits/38000/
10	https://www.exploit-db.com/exploits/38000/
11	https://www.exploit-db.com/exploits/40004/
12	https://www.exploit-db.com/exploits/40004/
13	https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html	Release Notes Third Party Advisory
14	https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html	Release Notes Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Wolf CMS における入力確認に関する脆弱性

Title	Wolf CMS における入力確認に関する脆弱性
Summary	Wolf CMS には、入力確認に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 攻撃が行われる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 11, 2015, midnight
Registration Date	May 15, 2017, 6:20 p.m.
Last Update	May 15, 2017, 6:20 p.m.

Affected System

wolfcms.org

Wolf CMS 0.8.3.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-6567	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6567
National Vulnerability Database (NVD)
2	CVE-2015-6567	https://nvd.nist.gov/vuln/detail/CVE-2015-6567

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
GitHub
1	Fix #619 and #625	https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa
2	Security patch 0.8.3.1	https://github.com/wolfcms/wolfcms/releases/tag/0.8.3.1
Wolf CMS
3	Wolf CMS - Stable Release: 0.8.3.1	https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html

Change Log

No	Changed Details	Date of change
0	[2017年05月15日] 掲載	Feb. 17, 2018, 10:37 a.m.