PT-2005-4818 · Sugarcrm · Sugarcrm

Publicado 2005-12-08 · Atualizado 2011-03-08 · CVE-2005-4086

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SugarCRM versions 4.0 beta and earlier

Description A directory traversal issue exists, allowing remote attackers to include arbitrary local files. This is achieved by using ".." sequences in the beanFiles array parameter in the acceptDecline.php file.

Recommendations For SugarCRM versions 4.0 beta and earlier, as a temporary workaround, consider restricting access to the acceptDecline.php file until a patch is available. Avoid using the beanFiles array parameter in the affected acceptDecline.php file until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2005-4086

Produtos afetados

Sugarcrm

Referências · 10

• 🔥 https://exploit-db.com/exploits/1364 · Exploit
• 🔥 http://securityfocus.com/archive/1/418840 · Exploit
• 🔥 https://exploit-db.com/exploits/1359 · Exploit
• 🔥 http://securityfocus.com/bid/15760 · Exploit
• http://securitytracker.com/id?1015322 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-4086 · Nota de Segurança
• http://rgod.altervista.org/sugar_suite_40beta.html · Nota
• http://vupen.com/english/advisories/2005/2800 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4086 · Nota
• http://secunia.com/advisories/17948 · Nota