CVE-2023-27060 : LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerab

LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.

Published 2023-03-22 22:15:13

Updated 2023-03-28 19:53:52

Source MITRE

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2023-27060

Lightcms Project » Lightcms » Version: 1.3.7
cpe:2.3:a:lightcms_project:lightcms:1.3.7:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.61%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 79 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

https://github.com/eddy8/LightCMS/issues/21

RCE vulnerability in lightcms v1.3.7 · Issue #21 · eddy8/LightCMS · GitHub
Exploit;Issue Tracking;Patch
https://igml.top/2021/05/10/lightcms-RCE/

lightcms后台RCE漏洞挖掘 | gml's blog
Exploit;Third Party Advisory

Jump to