Description (CNA)
/edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then publicly accessible under the /static URI.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| thiagoralves / OpenPLC_v3 | affected 0 through 9cd8f1b53a50f9d38708096bfc72bcbb1ef47343 |
CWE
CWE-434
References
- https://github.com/thiagoralves/OpenPLC_v3/blob/9cd8f1b53a50f9d38708096bfc72bcbb1ef47343/webserver/pages.py#L992
- https://github.com/Eyodav/OpenPLC-Insecure-File-Upload
ADP enrichment
No English description supplied.
No references supplied.