CVE-2018-12939

A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary…

published July 31, 2018

CVSS
—
EPSS
2%
Percentile
80.2
In the wild
Unconfirmed
What it is

A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary files via a .. (dot dot) in the "op/op.UploadChunks.php" "qquuid" parameter. NOTE: this can be leveraged to execute arbitrary code by using CVE-2018-12940.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01969 · 80.2th percentile
Published
2018-07-31T14:00Z
EPSS history
Timeline
  • 31 JUL 14:00Z
    A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary…
    cvelistv5