CVE-2016-1713

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in…

published April 14, 2017

CVSS

—

EPSS

17%

Percentile

97.0

In the wild

Unconfirmed

What it is

Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in test/logo/. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6000.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.16561 · 97.0th percentile
Published: 2017-04-14T18:00Z

EPSS history

Timeline

14 APR 18:00Z
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in…
cvelistv5