CVSSv3 Calculator

Vulnerability type

Please select vulnerability type according to CWE classification:

Impact

Choose impact:

The vulnerability permits to read arbitrary files with privileges of the current process. The vulnerability permits to modify arbitrary files with privileges of the current process. The vulnerability permits to delete web application files with privileges of the current process. The vulnerability permits to launch applications and execute OS commands with privileges of the current process.

Impact

Choose impact:

Successful vulnerability exploitation permits certain confidential information to be read by an attacker. Successful vulnerability exploitation permits certain information to be modified by an attacker. Successful vulnerability exploitation permits to delete certain data or to prevent legitimate users from accessing certain information. Successful vulnerability exploitation gives full (unlimited) access to the vulnerable web application. Successful vulnerability exploitation permits to execute arbitrary OS commands.

Impact

Choose impact:

The vulnerability permits to get access to some confidential information. The vulnerability permits to modify certain data with privileges of another user, however does not grant access to the web application. Successful exploitation of the vulnerability permits to block legitimate users from accessing the system and/or its functionality. Successful exploitation of the vulnerability gives administrator’s (unlimited) access to the vulnerable system. The vulnerability permits to execute arbitrary OS commands

Uploading executable files

Vulnerability allow to upload server-side executable files, and execute it in server:

No Yes

Exploitation via CSRF vector

Is CSRF vector the sole or the most efficient vector of exploitation of the vulnerability?

Yes No

Authentication types

Should the attacker have valid credentials and be logged-in to exploit this vulnerability?

No Yes, however the registration is open by default. Yes, however the registration is closed by default. Yes, moreover a sort of special privileges are also required (e.g. moderator or administrator privileges).

Supplementary exploitation requirements

Do any special or additional conditions exist to make vulnerability exploitable?

Exploitation of the vulnerability does not depend on system or server configuration. The vulnerability is present in default system and webserver configurations. Successful exploitation of the vulnerability requires a non-default configuration of a system or a webserver. Successful exploitation of the vulnerability requires a very rare non-default configuration of a system or a webserver.

CVSSv3 Base Score

We suggest the following CVSSv3 Base Score for your vulnerability:

Web Applications Vulnerabilities Scoring

Vulnerability type

Impact

Impact

Impact

XSS types

Uploading executable files

PHP injection types

Exploitation via CSRF vector

Authentication types

Supplementary exploitation requirements

CVSSv3 Base Score