Path Traversal in Pkp Open Journal Systems
CVE-2012-1467
Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.030 (86.0th percentile) — read the EPSS interpretation.
Affected products
- Pkp Open_journal_systems
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (Exploit, x_refsource_MISC)