Critical severityNVD Advisory· Published Oct 30, 2018· Updated Aug 5, 2024
CVE-2018-18830
CVE-2018-18830
Description
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
net.mingsoft:ms-mcmsMaven | <= 4.6.5 | — |
Affected products
1Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-c7c7-xm8g-xm36ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-18830ghsaADVISORY
- gitee.com/mingSoft/MCMS/issues/IO0IQghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.