PT-2006-5368 · Unknown · The Address Book

Publicado 2006-12-31 · Atualizado 2017-07-20 · CVE-2006-4581

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions The Address Book version 1.04e

Description The issue concerns an unrestricted file upload vulnerability. It allows remote attackers to upload arbitrary PHP scripts because the software validates the Content-Type header but not the file extension.

Recommendations For version 1.04e, consider restricting file uploads to only allow specific, necessary file extensions as a temporary workaround until a patch is available. Additionally, validate both the Content-Type header and the file extension to prevent uploading arbitrary scripts.

Correção

Identificadores relacionados

CVE-2006-4581

Produtos afetados

The Address Book

Referências · 6

• http://secunia.com/secunia_research/2006-76/advisory · Aviso do Fabricante
• http://secunia.com/advisories/21694 · Aviso do Fabricante
• http://osvdb.org/32560 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4581 · Nota de Segurança
• http://securityfocus.com/bid/21870 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31250 · Nota