CVE-2023-36220
HighCVSS 7.2Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.
Risk Assessment
The organization may be exposed to unauthorized data access and the potential execution of malicious code, leading to serious security breaches.
Recommendation
It is recommended to update Textpattern CMS to the latest version to mitigate this vulnerability and review the system's security.
Other vulnerabilities in Textpattern CMS v4.8.8
See all- CVE-2021-47976High
TextPattern CMS version 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.
- CVE-2021-47943High
TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files via the file upload functionality. Attackers can upload a PHP shell via the Files section and execute commands by accessing the uploaded file with GET parameters passed to the system function.
Original NVD description (English source)
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.