Vulnerability Details CVE-2018-1306
The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.698
EPSS Ranking 98.6%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.0
References