Vulnerability Description
Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized file.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zikula | Zikula Application Framework | 1.3.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/95005Third Party AdvisoryVDB Entry
- https://github.com/zikula/core/blob/1.3/CHANGELOG-1.3.mdIssue TrackingPatchRelease Notes
- https://github.com/zikula/core/blob/1.4/CHANGELOG-1.4.mdIssue TrackingPatchRelease Notes
- https://github.com/zikula/core/issues/3237Issue TrackingPatchThird Party Advisory
- http://www.securityfocus.com/bid/95005Third Party AdvisoryVDB Entry
- https://github.com/zikula/core/blob/1.3/CHANGELOG-1.3.mdIssue TrackingPatchRelease Notes
- https://github.com/zikula/core/blob/1.4/CHANGELOG-1.4.mdIssue TrackingPatchRelease Notes
- https://github.com/zikula/core/issues/3237Issue TrackingPatchThird Party Advisory
FAQ
What is CVE-2016-9835?
CVE-2016-9835 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Directory traversal vulnerability in file "jcss.php" in Zikula 1.3.x before 1.3.11 and 1.4.x before 1.4.4 on Windows allows a remote attacker to launch a PHP object injection by uploading a serialized...
How severe is CVE-2016-9835?
CVE-2016-9835 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-9835?
Check the references section above for vendor advisories and patch information. Affected products include: Zikula Zikula Application Framework.