vendor:
Pluck CMS
by:
Ashish Koli (Shikari)
7.2
CVSS
HIGH
Remote Code Execution (RCE)
78
CWE
Product Name: Pluck CMS
Affected Version From: 4.7.16
Affected Version To: 4.7.15
Patch Exists: YES
Related CWE: CVE-2022-26965
CPE: a:pluck_cms:pluck
Platforms Tested: Ubuntu 20.04.3 LTS
2022
Pluck CMS 4.7.16 – Remote Code Execution (RCE) (Authenticated)
A theme upload functinality in Pluck CMS before 4.7.16 allows an admin privileged user to gain access in the host through the "themes files", which may result in remote code execution.
Mitigation:
Upgrade to Pluck CMS version 4.7.16 or later.
