Unscored severity · published Oct 28, 2015
CVE-2015-7904
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP…
–
CVSS
2.8%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mango Automation · Infinite Automation Systems
2.5.0; 2.5.5; 2.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7904
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7904
Patch
https://ics-cert.us-cert.gov/advisories/ICSA-15-300-02
More from Mango Automation
–
CVE-2015-7903
SQL injection vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary SQL commands via…
–
CVE-2015-7902
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 provides different error messages for failed login attempts in unspecified circumstances, which allows…
–
CVE-2015-7901
Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors
–
CVE-2015-7900
Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote attackers to obtain sensitive debugging information by entering a crafted URL to trigger…
–
CVE-2015-6494
Cross-site scripting (XSS) vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to inject arbitrary web…