תיאור (מקור, אנגלית)
A flaw has been found in Frappe LMS 2.35.0. Impacted is an unknown function of the file /files/ of the component Assignment Picture Handler. This manipulation causes direct request. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
מוצרים מושפעים
frappe: learning
קישורים8
- gist.github.com/0xHamy/beb840a754f50a7ee6500600147a6ac1 ExploitThird Party Advisory
- gist.github.com/0xHamy/beb840a754f50a7ee6500600147a6ac1#steps-… ExploitThird Party Advisory
- vuldb.com/?submit.659694 ExploitThird Party AdvisoryVDB Entry
- gist.github.com/0xHamy/beb840a754f50a7ee6500600147a6ac1 ExploitThird Party Advisory
- gist.github.com/0xHamy/beb840a754f50a7ee6500600147a6ac1#steps-… ExploitThird Party Advisory
- vuldb.com/?submit.659694 ExploitThird Party AdvisoryVDB Entry
- vuldb.com/?ctiid.327014 Permissions RequiredVDB Entry
- vuldb.com/?id.327014 Third Party AdvisoryVDB Entry
מדדים
- CVSS 3.1
-
3.7
LOW
מקור הציון: CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 4.0
-
2.9
LOW
מקור הציון: CNA
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — סבירות ניצול
- 0% אחוזון 42 · נכון ל-9 בנובמבר 2026
- CWE
- CWE-425
האם אפשר לנצל את הפגיעות הזו אצלכם?
עדכון אבטחה סוגר את הפרצה הידועה. בדיקת חדירות מראה לאן תוקף עדיין יכול להגיע — עם הוכחה.