PT-2002-2088 · Ez · Ezcontents

Publicado 2002-08-31 · Atualizado 2008-09-05 · CVE-2002-1083

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: ezContents versions 1.41 and earlier

Description: The issue allows remote attackers to cause ezContents to create directories or list directories via .. (dot dot) sequences. This can be achieved through the Maintain Images:Add New:Create Subdirectory item or the Maintain Images file listing.

Recommendations: For ezContents versions 1.41 and earlier, consider restricting access to the Maintain Images feature until a fix is available. As a temporary workaround, avoid using the .. (dot dot) sequences in the Maintain Images file listing and the Create Subdirectory item to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2002-1083

Produtos afetados

Ezcontents

Referências · 4

• http://online.securityfocus.com/archive/1/284229 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1083 · Nota de Segurança
• http://iss.net/security_center/static/9710.php · Aviso do Fabricante
• http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0040.html · Nota