CVE-2018-6383

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which…

published January 29, 2018

CVSS

—

EPSS

13%

Percentile

96.4

In the wild

Unconfirmed

What it is

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.13499 · 96.4th percentile
Published: 2018-01-29T18:00Z

EPSS history

Timeline

29 JAN 18:00Z
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which…
cvelistv5