CVE-2012-1207

描述

Directory traversal vulnerability in `frontend/core/engine/javascript.php` in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a `..` (dot dot) in the module parameter to `frontend/js.php`.

如何修補 CVE-2012-1207

要修補 CVE-2012-1207,請將受影響套件升級到下列已修補版本。

• Packagist/forkcms/forkcms—升級至 3.2.5 或更新版本

CVE-2012-1207 正在被利用嗎?

低 — EPSS 為 1.9%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 3.2.5

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2012-1207
• PATCHgithub.com/forkcms/forkcms
• WEBpacketstormsecurity.org/files/109709/Fork-CMS-3.2.4-Cross-Site-Scripting-Local-File-Inclusion.html
• WEBwww.fork-cms.com/blog/detail/fork-cms-3-2-5-released