Vulnerability in Infinite Automation Systems Mango
CVE-2015-7904
Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.
EPSS: 0.028 (84.9th percentile) — read the EPSS interpretation.
Affected products
- Infinite_automation_systems Mango_automation — versions 2.5.0, 2.5.5, 2.6.0
- N/a — versions n/a
References
- ics-cert@hq.dhs.gov (US Government Resource, Patch, Third Party Advisory, x_refsource_MISC)