CVE-2015-7904
published 2015-10-28CVE-2015-7904: Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to…
PriorityP344medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EXPLOIT
EPSS
2.78%
84.6th percentile
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| infinite_automation_systems | mango_automation | — | — |
| infinite_automation_systems | mango_automation | — | — |
| infinite_automation_systems | mango_automation | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r5vj-6v5w-753q: Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2
ghsa_unreviewed·2022-05-17
CVE-2015-7904 [MEDIUM] GHSA-r5vj-6v5w-753q: Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
CISA ICS
Infinite Automation Systems Mango Automation Vulnerabilities (Update A)
cisa_ics·2015-10-27
Infinite Automation Systems Mango Automation Vulnerabilities (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Infinite Automation Systems Mango Automation Vulnerabilities (Update A)
Last RevisedAugust 27, 2018
Alert CodeICSA-15-300-02A
## OVERVIEW
This updated advisory is a follow-up to the original advisory titled ISCA-15-300-02 Infinite Automation Systems Mango Automation Vulnerabilities that was published October 27, 2015, on the NCCIC/ICS-CERT web site.
Steven Seeley of Source Incite and Gjoko Krstic of Zero Science Lab have independently identified vulnerabilities in the Infinite Automation Systems Mango Automation application.
## --------- Begin Update A Part 1 of 3 --------
In
No detection rules found.
No writeups or analysis indexed.
2015-10-28
Published