VulnerabilityModified
CVE-2015-4425
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a ..
MEDIUM 4.9EPSS 3.81%
Does this matter?
Lower severity and a low EPSS score (3.81%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
- CVSS 2.0
- 4.9 MEDIUMAV:N/AC:M/Au:S/C:N/I:P/A:P
- EPSS
- 3.81% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- pimcore/pimcore
- Source
- cve@mitre.org
References
- http://seclists.org/fulldisclosure/2015/Jul/57
- https://github.com/pimcore/pimcore/commit/4f2a95f877d406a054f9f2253475fe58c76aa03d
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-4425/Exploit
- http://seclists.org/fulldisclosure/2015/Jul/57
- https://github.com/pimcore/pimcore/commit/4f2a95f877d406a054f9f2253475fe58c76aa03d
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-4425/Exploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.