PT-2005-1336 · Phpbb · Phpbb

Publicado 2005-02-22 · Atualizado 2008-09-10 · CVE-2005-0258

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions phpBB versions 2.0.11 and possibly other versions

Description A directory traversal issue exists, allowing remote attackers to delete arbitrary files. This is achieved by using "/../" sequences in the avatarselect parameter of the "usercp register.php" and "usercp avatar.php" scripts when gallery avatars are enabled.

Recommendations For phpBB version 2.0.11, consider disabling the gallery avatars feature to prevent exploitation until a fix is available. Restrict access to the "usercp register.php" and "usercp avatar.php" scripts to minimize the risk of exploitation. Avoid using the avatarselect parameter in the affected scripts until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-0258

Produtos afetados

Phpbb

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0258 · Nota
• http://idefense.com/application/poi/display?id=205&type=vulnerabilities · Aviso do Fabricante
• http://gentoo.org/security/en/glsa/glsa-200503-02.xml · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-0258 · Nota de Segurança
• http://phpbb.com/support/documents.php?mode=changelog · Aviso do Fabricante