CVE-2017-17793 Information

Description

Information Disclosure vulnerability in creer_fichier_zip in admin/maintenance.php in BlogoText through 3.7.6 allows remote attackers to defeat a filename-randomization protection mechanism and read backup archives on Windows servers by providing the archiv~1.zip name (aka an 8.3 filename).

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Reference

https://github.com/BlogoText/blogotext/commit/101dc1d37010a1d877d6961ed2f32d089c708e91 https://github.com/BlogoText/blogotext/issues/345

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

NONE

Base Score

NONE

Base Severity

7.5