CVE-2022-46610

Exploit

EPSS 3.46%
Published 10.01.2023 14:15:10
Last modified 09.04.2025 16:15:21
Source cve@mitre.org
Teams watchlist Login
Open Login

72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

72crm ≫ Wukong Crm Version9.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	3.46%	0.87

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://github.com/72wukong/72crm-9.0-PHP/issues/36

Third Party Advisory

Exploit

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2022-46610

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-46610

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-46610

EUVD