PT-2002-2563 · Nola · Nola

CVE-2002-1841 · Publicado 2002-12-31 · Atualizado 2024-01-26

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NOLA versions 1.1.1 through 1.1.2

Description The document management module does not restrict the types of files that are uploaded, allowing remote attackers to upload and execute arbitrary PHP files with extensions such as .php4.

Recommendations For versions 1.1.1 and 1.1.2, restrict the types of files that can be uploaded to the document management module to prevent the execution of arbitrary PHP files. As a temporary workaround, consider disabling the file upload feature in the document management module until a patch is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2002-1841

Produtos afetados

Nola

Referências · 7

• http://securityfocus.com/bid/5116 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2002-1841 · Nota de Segurança
• http://online.securityfocus.com/archive/1/280340 · Nota
• http://iss.net/security_center/static/9438.php · Nota
• https://t.me/cvenotify/68956 · Publicação no Telegram
• http://marc.info/?l=vuln-dev&m=102520790718208&w=2 · Nota
• http://marc.info/?l=vuln-dev&m=102511114021370&w=2 · Nota