CVE-2017-1000119

EPSS 61.3%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 61.3%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

25 Apr 2017Metasploit module available

04 Oct 2017Published on NVD

10 Sep 2019Public PoC

Weaponization speed

706 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/47376unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://octobercms.com/support/article/rn-8 http://packetstormsecurity.com/files/154390/October-CMS-Upload-Protection-Bypass-Code-Execution.html