CVE-2017-6027

CWE-434 — Unrestricted File Upload3 documents3 sources
Severity
9.8CRITICAL
EPSS
1.9%
top 16.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Codesys WEB Server
Timeline
PublishedMay 19
Latest updateMay 13

Description

An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, part of the CODESYS WebVisu web browser visualization software, are affected: CODESYS Web Server Versions 2.3 and prior. A specially crafted web server request may allow the upload of arbitrary files (with a dangerous type) to the CODESYS Web Server without authorization which may allow remote code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV53s-smart_software_solutions_gmbh_codesys_web_server3S-Smart Software Solutions GmbH CODESYS Web Server

🔴Vulnerability Details

2
GHSA
GHSA-r8qw-6xxq-mjrp: An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server↗2022-05-13
▶
CVEList
CVE-2017-6027: An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server↗2017-05-19
▶
CVE-2017-6027 (CRITICAL CVSS 9.8) | An Arbitrary File Upload issue was | cvebase.io