Description
The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x before 6.3.8-s1 allows remote attackers to conduct PHP Object Injection attacks by intercepting a request to update.webedition.org.
References (5)
Core 5
Core References
Exploit, Mailing List, Third Party Advisory mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/May/147
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/126861/webEdition-CMS-2.8.0.0-Remote-Command-Execution.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/67692
Exploit, Third Party Advisory x_refsource_misc
https://www.redteam-pentesting.de/advisories/rt-sa-2014-004
Exploit, Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/532230/100/0/threaded
Scores
CVSS v3
9.8
EPSS
0.0452
EPSS Percentile
90.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-94
Status
published
Products (3)
webedition/webedition_cms
6.2.7.0 s1
webedition/webedition_cms
6.3.8 s1
webedition/webedition_cms
< 6.2.7.0
Published
Jul 19, 2018
Tracked Since
Feb 18, 2026