Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems prior to 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
pkp open journal systems |