Description

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.

Remediation

References

CVE-2017-1000002

Related Vulnerabilities

WordPress Plugin All-in-One WP Migration Multiple Cross-Site Request Forgery Vulnerabilities (7.1)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-0798)

MyBB Permissions, Privileges, and Access Controls Vulnerability (CVE-2016-9403)

WordPress Plugin Grid Gallery-Photo Image Grid Gallery Cross-Site Scripting (1.2.4)

WordPress 6.0.x Shortcode Execution (6.0 - 6.0.4)

Severity

Critical

Classification

CVE-2017-1000002 CWE-22 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities