CVE-2017-5869

HIGH

8.8

CVSS Severity Score

EPSS Score0.0330%

EPSS Percentile13.15th

Published2017年3月24日

Last Modified2026年5月13日

Vulnerability Description

Directory traversal vulnerability in the file import feature in Nuxeo Platform 6.0, 7.1, 7.2, and 7.3 allows remote authenticated users to upload and execute arbitrary JSP code via a .. (dot dot) in the X-File-Name header.

Affected Platforms (CPE)

📦

Nuxeo

= 6.0

📦

Nuxeo

= 7.1

📦

Nuxeo

= 7.2

📦

Nuxeo

= 7.3

References & Advisories

🔗 http://www.openwall.com/lists/oss-security/2017/03/23/6

🔗 http://www.securityfocus.com/bid/97083

🔗 https://sysdream.com/news/lab/2017-03-23-cve-2017-5869-nuxeo-platform-remote-code-execution/

🔗 https://www.exploit-db.com/exploits/41748/

🔗 http://www.openwall.com/lists/oss-security/2017/03/23/6

🔗 http://www.securityfocus.com/bid/97083

🔗 https://sysdream.com/news/lab/2017-03-23-cve-2017-5869-nuxeo-platform-remote-code-execution/

🔗 https://www.exploit-db.com/exploits/41748/

Vulnerability Description

Affected Platforms (CPE)

Nuxeo

Nuxeo

Nuxeo

Nuxeo

References & Advisories

関連する脆弱性情報