Vulnerability Description
The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
CVSS Score
6.5
MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Boltcms | Bolt | <= 2.2.0 |
Related Weaknesses (CWE)
References
- http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.htmlExploit
- http://packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.htmlExploit
- http://seclists.org/fulldisclosure/2015/Aug/66Exploit
- http://www.rapid7.com/db/modules/exploit/multi/http/bolt_file_uploadExploit
- https://bolt.cm/newsitem/bolt-2-2-5-releasedPatchVendor Advisory
- https://www.exploit-db.com/exploits/38196/Exploit
- http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.htmlExploit
- http://packetstormsecurity.com/files/133539/CMS-Bolt-2.2.4-File-Upload.htmlExploit
- http://seclists.org/fulldisclosure/2015/Aug/66Exploit
- http://www.rapid7.com/db/modules/exploit/multi/http/bolt_file_uploadExploit
- https://bolt.cm/newsitem/bolt-2-2-5-releasedPatchVendor Advisory
- https://www.exploit-db.com/exploits/38196/Exploit
FAQ
What is CVE-2015-7309?
CVE-2015-7309 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then direc...
How severe is CVE-2015-7309?
CVE-2015-7309 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7309?
Check the references section above for vendor advisories and patch information. Affected products include: Boltcms Bolt.