PT-2002-2352 · Mike Spice · Mike Spice Quiz Me!

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1627

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mike Spice Quiz Me! versions prior to 0.6

Description The issue allows remote attackers to write arbitrary files due to a directory traversal vulnerability in the quiz.cgi component. This is achieved by using .. (dot dot) sequences in the quiz parameter.

Recommendations For versions prior to 0.6, update to version 0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the quiz.cgi component to minimize the risk of exploitation. Avoid using the quiz parameter with unvalidated input until the issue is resolved.

Correção

Identificadores relacionados

CVE-2002-1627

Produtos afetados

Mike Spice Quiz Me!

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/7970 · Nota
• http://securitytracker.com/id?1003254 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1627 · Nota de Segurança
• http://securityfocus.com/bid/3857 · Correção
• http://kb.cert.org/vuls/id/318835 · Correção