NVD

Id
85941  
Name
CVE-2017-5965  
Description
The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP code by creating a ZIP archive in which a .asp file has a .. in its pathname, visiting sitecore/shell/applications/install/dialogs/Upload%20Package/UploadPackage2.aspx to upload this archive and extract its contents, and visiting a URI under sitecore/ to execute the .asp file.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-06-12  
Published
2017-05-23  
Modified Date
2017-06-08  
Seq
2017-5965  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
422576 85941 CVE-2017-0341 http://nvidia.custhelp.com/app/answers/detail/a_id/4462  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
68302 JVNDB-2017-004559 Sitecore CRM のパッケージマネージャにおける任意の ASP コードを実行される脆弱性 Sitecore CRM のパッケージマネージャには、任意の ASP コードを実行される脆弱性が存在します。 CVE-2017-5965 0 CVE-2017-5965 85941 6.5 6.7 http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-004559.html 2017-05-19 2017-06-29 View