CVE-2016-11020

Katalog CVE

CVSS 9.8 · Critical EPSS 2,9%

Kerentanan Unrestricted Upload of File with Dangerous Type pada kunena. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution.

Rincian

Terbit di NVD

25 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.kunena.org/blog/179-kunena-5-0-4-released release notes · advisory vendor
• https://www.kunena.org/bugs/changelog release notes · advisory vendor
• https://github.com/Kunena/Kunena-Forum/pull/5028 patch · advisory pihak ketiga