PT-2006-3461 · Apache+1 · Apache+2

Publicado 2006-05-22 · Atualizado 2017-07-20 · CVE-2006-2514

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Coppermine galleries versions prior to 1.4.6

Description The issue allows remote attackers to upload arbitrary files by utilizing a filename with multiple file extensions, specifically when the software is running on Apache with mod mime installed.

Recommendations For versions prior to 1.4.6, update to version 1.4.6 or later to resolve the issue. As a temporary workaround, consider restricting file uploads or disabling the use of multiple file extensions in filenames until the update is applied.

Correção

Identificadores relacionados

CVE-2006-2514

Produtos afetados

Apache

Coppermine

Mod Mime

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26588 · Nota
• http://secunia.com/advisories/20211 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-2514 · Nota de Segurança
• http://sourceforge.net/project/shownotes.php?group_id=89658&release_id=418266 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2514 · Nota
• http://vupen.com/english/advisories/2006/1892 · Nota