A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of the component org.marker.mushroom.controller.FileController. The manipulation of the argument path/name leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
References
| Link | Resource |
|---|---|
| https://github.com/IceFoxH/VULN/issues/1 | Exploit Third Party Advisory Issue Tracking |
| https://github.com/IceFoxH/VULN/issues/1 | Exploit Third Party Advisory Issue Tracking |
| https://vuldb.com/?ctiid.299218 | Permissions Required VDB Entry |
| https://vuldb.com/?id.299218 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.511724 | Third Party Advisory VDB Entry |
Configurations
History
09 Apr 2025, 20:48
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mrcms mrcms
Mrcms |
|
| CWE | CWE-22 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.1 |
| CPE | cpe:2.3:a:mrcms:mrcms:3.1.2:*:*:*:*:*:*:* | |
| References | () https://vuldb.com/?submit.511724 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?ctiid.299218 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.299218 - Third Party Advisory, VDB Entry | |
| References | () https://github.com/IceFoxH/VULN/issues/1 - Exploit, Third Party Advisory, Issue Tracking |
11 Mar 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | ||
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : unknown |
11 Mar 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-11 13:15
Updated : 2025-04-09 20:48
NVD link : CVE-2025-2193
Mitre link : CVE-2025-2193
JSON object : View
Products Affected
mrcms
- mrcms
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')