CVE-2015-2780

Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://seclists.org/fulldisclosure/2015/Mar/155	Issue Tracking Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/28/4	Issue Tracking Mailing List Patch Third Party Advisory
https://www.exploit-db.com/exploits/36520/	Issue Tracking Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2015/Mar/155	Issue Tracking Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/28/4	Issue Tracking Mailing List Patch Third Party Advisory
https://www.exploit-db.com/exploits/36520/	Issue Tracking Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:berta:berta_cms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2017-10-16 18:29

Updated : 2025-04-20 01:37

NVD link : CVE-2015-2780

Mitre link : CVE-2015-2780

CVE.ORG link : CVE-2015-2780

JSON object : View

Products Affected

berta

berta_cms

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2015-2780", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-10-16T18:29:00.313", "references": [{"url": "http://seclists.org/fulldisclosure/2015/Mar/155", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2015/03/28/4", "tags": ["Issue Tracking", "Mailing List", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/36520/", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2015/Mar/155", "tags": ["Issue Tracking", "Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2015/03/28/4", "tags": ["Issue Tracking", "Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/36520/", "tags": ["Issue Tracking", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension, then accessing it via a direct request to the file in an unspecified directory."}, {"lang": "es", "value": "Una vulnerabilidad de subida de archivos sin restricci\u00f3n en Berta CMS permite que atacantes remotos ejecuten c\u00f3digo arbitrario mediante la subida de un archivo de imagen manipulado con una extensi\u00f3n ejecutable y, a continuaci\u00f3n, acceder a este por medio de una petici\u00f3n directa al archivo en un directorio sin especificar."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:berta:berta_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8A22BC4-2713-47E4-8415-953EC455D223", "versionEndIncluding": "0.8.9b"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}