CVE-2021-44664

An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously…

published February 24, 2022

CVSS

—

EPSS

13%

Percentile

96.3

In the wild

Unconfirmed

What it is

An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.12782 · 96.3th percentile
Published: 2022-02-24T20:11Z

EPSS history

Timeline

24 FEB 20:11Z
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously…
cvelistv5