CVE-2015-7773
Last modified
CVE-2015-7773 is a vulnerability of currently unknown severity. Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension.. EPSS estimates a 1.26% chance of exploitation in the next 30 days.
Description
Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Bastian Allgeier | Kirby | <= 2.1.1 |
References
- http://getkirby.com/changelog/kirby-2-1-2Patch, Vendor Advisory
- http://jvn.jp/en/jp/JVN34780384/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000182Vendor Advisory
- http://getkirby.com/changelog/kirby-2-1-2Patch, Vendor Advisory
- http://jvn.jp/en/jp/JVN34780384/index.htmlVendor Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2015-000182Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-7773?
How severe is CVE-2015-7773?
How do I fix CVE-2015-7773?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-7767Buffer overflow in Konica Minolta FTP Utility 1.0 allows rem…
- CVE-2015-7768Buffer overflow in Konica Minolta FTP Utility 1.0 allows rem…
- CVE-2015-7769baserCMS 3.0.2 through 3.0.8 allows remote authenticated use…
- CVE-2015-7770Dell SonicWall TotalSecure TZ 100 devices with firmware befo…
- CVE-2015-7771Cross-site scripting (XSS) vulnerability in the runtime engi…
- CVE-2015-7772Cross-site scripting (XSS) vulnerability in the runtime engi…
- CVE-2015-7774PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4…
- CVE-2015-7775Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.…
- CVE-2015-7776Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly res…
- CVE-2015-7777Cross-site scripting (XSS) vulnerability in index.php in Jos…
- CVE-2015-7778Gurunavi App for iOS before 6.0.0 does not verify SSL certif…
- CVE-2015-7779Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2015-7773?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST