CVE-2014-8739
jQuery File Upload Plugin Unrestricted file upload vulnerability
EPSS 91.7%
描述
Unrestricted file upload vulnerability in `server/php/UploadHandler.php` in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in `files/`, as exploited in the wild in October 2014.
如何修補 CVE-2014-8739
目前尚未發布修補版本。可考慮移除受影響套件,或參考下方連結中的上游建議。
- —未列出修補版本
CVE-2014-8739 正在被利用嗎?
可能 — EPSS 為 91.7%,屬於高被利用機率區間,建議優先修補。