Description (CNA)
A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The attack may be performed from remote. The exploit is now public and may be used.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| xiweicheng / TMS | affected 2.0; affected 2.1; affected 2.2; affected 2.3; affected 2.4; affected 2.5; affected 2.6; affected 2.7; affected 2.8; affected 2.9; affected 2.10; affected 2.11; affected 2.12; affected 2.13; affected 2.14; affected 2.15; affected 2.16; affected 2.17; affected 2.18; affected 2.19; affected 2.20; affected 2.21; affected 2.22; affected 2.23; affected 2.24; affected 2.25; affected 2.26; affected 2.27; affected 2.28.0 |
CWE
CWE-434, CWE-284
References
- https://vuldb.com/?id.341629
- https://vuldb.com/?ctiid.341629
- https://vuldb.com/?submit.731240
- https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
ADP enrichment
No English description supplied.
No references supplied.