lei feng tv cms vulnerabilities and fixes

Recent CVEs affecting lei feng tv cms, with upgrade or downgrade steps. 3 tracked.

Also searched as: leifengtvcms.

lei feng tv cms has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2018-12-30. Highest priority: CVE-2018-20602 (score 54/100).

• CVE-2018-20604 MEDIUM 4.9 DOWNGRADE Lei Feng TV CMS (aka LFCMS) 3.8.6 allows Directory Traversal via crafted use of ..* in Template/edit/path URIs
• CVE-2018-20603 HIGH 8.8 DOWNGRADE Lei Feng TV CMS (aka LFCMS) 3.8.6 allows admin.php?s=/Member/add.html CSRF.
• CVE-2018-20602 HIGH 7.5 DOWNGRADE Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI.

FAQ

How do I fix lei feng tv cms vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is lei feng tv cms being exploited right now?

None of the tracked lei feng tv cms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which lei feng tv cms CVE should I patch first?

CVE-2018-20602 currently ranks highest (54/100): Lei Feng TV CMS (aka LFCMS) 3.8.6 allows full path disclosure via the /install.php?s=/1 URI..

RSS feed for lei feng tv cms · ← Back to latest CVEs