PT-2006-3476 · Ckeditor · Ckeditor

Publicado 2006-05-22 · Atualizado 2011-03-08 · CVE-2006-2529

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FCKeditor versions prior to 2.3 Beta

Description The issue concerns the upload feature in FCKeditor, where the Type parameter is not properly verified, allowing remote attackers to upload arbitrary file types.

Recommendations For versions prior to 2.3 Beta, consider disabling the upload feature until a patch is available. Restrict access to the upload.php file in the editor/filemanager/upload/php directory to minimize the risk of exploitation. Avoid using the Type parameter in the affected upload functionality until the issue is resolved.

Correção

Identificadores relacionados

CVE-2006-2529

Produtos afetados

Ckeditor

Referências · 7

• http://fckeditor.net/whatsnew/default.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2006-2529 · Nota de Segurança
• http://vupen.com/english/advisories/2006/1856 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2529 · Nota
• http://securityfocus.com/bid/18029 · Correção
• http://secunia.com/advisories/20122 · Aviso do Fabricante
• http://osvdb.org/25631 · Nota