PT-2006-3041 · Invision · Invision Power Board

Iceshaman + 1 · Publicado 2006-04-26 · Atualizado 2018-10-18 · CVE-2006-2060

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board (IPB) versions 2.0.x through 2.1.x

Description The issue allows remote authenticated administrators to include and execute arbitrary local PHP files via a .. (dot dot) in the name parameter, preceded by enough backspace (%08) characters to erase the initial static portion of a filename. This is a directory traversal vulnerability.

Recommendations For Invision Power Board (IPB) versions 2.0.x through 2.1.x, update to a version released after 20060425 to resolve the issue.

Correção

Identificadores relacionados

CVE-2006-2060

Produtos afetados

Invision Power Board

Referências · 11

• http://forums.invisionpower.com/index.php?showtopic=213374 · Correção
• http://securityreason.com/securityalert/796 · Nota
• http://securityfocus.com/archive/1/439607/100/0/threaded · Nota
• http://osvdb.org/25008 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2060 · Nota
• http://secunia.com/advisories/19830 · Nota
• http://vupen.com/english/advisories/2006/1534 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26072 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2060 · Nota de Segurança
• http://securityfocus.com/archive/1/431990/100/0/threaded · Nota
• http://securityfocus.com/archive/1/432226/100/0/threaded · Nota