What is CVE-2018-16784?

CVE-2018-16784 is a high-severity vulnerability; its CVE record was published on September 21, 2018. DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "\u003cfile type='file' name='../" substring.

When was CVE-2018-16784 made public?

CVE-2018-16784 was made public on September 11, 2018: that is the date its CVE record's CNA, MITRE Corporation, gives for when the vulnerability was made public. The CVE record itself was published on September 21, 2018. EchelonGraph's copy of the record carries a last-modified date of November 21, 2024; the record at its source may have been updated since.

Is CVE-2018-16784 actively exploited?

CVE-2018-16784 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 2.3% probability of exploitation in the next 30 days (83rd percentile of EPSS-scored CVEs).

What is the CVSS score of CVE-2018-16784?

CVE-2018-16784 has a CVSS v3 base score of 7.2 (NVD).

How do I remediate CVE-2018-16784?

No fix for CVE-2018-16784 has been recorded since its CVE record was published in 2018. If the vendor still supports the product, apply the fixed version it names; if it no longer does, isolate the affected system (restrict network access to it, for example with a firewall, or keep it off the internet) or retire the product.

CVE-2018-16784

HIGHNVD 7.27.2Trending — 3 sources updated this week

Also known asEUVD-2018-8584 (ENISA EUVD) · GHSA-mr9x-r224-2f2x (GitHub Security Advisories)Source: ENISA EUVD

7.2EG

EchelonGraph verdictPlan mitigationNo fix on record since 2018: if the vendor still supports the product, apply the fixed version it names within your standard update timelines; if it no longer does, isolate the affected system on your normal schedule, or retire the product (the SSVC decision on this page).

High severity, but no confirmed exploitation yet

CISA-KEV: Not listedEPSS PROB: 2.3%CVSS: 7.2Exploit: None knownExposed services: Not assessed

No fix has been recorded since the CVE record was published in 2018 — if the vendor still supports the product, apply the fixed version it names; if not, isolate the affected system (restrict network access to it, for example with a firewall, or keep it off the internet) or retire the product.

DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "