Quick answers
- Is CVE-2017-5480 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2017-5480 being exploited in the wild.
- How severe is CVE-2017-5480?
- High severity, with a CVSS score of 8.1, published 15 January 2017.
- Which products and versions are affected?
- b2evolution b2evolution through 6.8.3.
- Is there a fix for CVE-2017-5480?
- A patch was published on 2017-01-15: Fix committed to b2evolution repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2017-5480 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2017-5480?
- Check whether you run B2evolution. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A directory traversal vulnerability exists in 'inc/files/files.ctrl.php' within b2evolution versions up to and including 6.8.3. The root cause is insufficient sanitization of the 'fm_selected' array parameter, which is used to specify file paths for operations. An authenticated attacker with back-office (administrative) privileges can inject '..' (dot-dot-slash) sequences into this parameter to escape the intended directory. This allows for the unauthorized reading or deletion of arbitrary files on the host filesystem. The issue was addressed in January 2017 via a commit that implements regex-based validation to block traversal patterns.
Affected products
- b2evolution b2evolution through 6.8.3
Timeline
- 2017-01-14: disclosed: Issue reported on GitHub by blackwolfsec
- 2017-01-15: advisory: NVD publication date
- 2017-01-15: patched: Fix committed to b2evolution repository