PT-2007-1965 · Drupal · Drupal

Publicado 2007-01-26 · Atualizado 2017-07-29 · CVE-2007-0505

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Drupal Project issue tracking module versions 4.7.0 through 5.x before 20070123

Description The issue allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.

Recommendations For versions 4.7.0 through 5.x before 20070123, consider restricting file uploads to only authorized users and validating file extensions to prevent executable files from being uploaded until a fix is available.

Correção

Identificadores relacionados

CVE-2007-0505

Produtos afetados

Drupal

Referências · 7

• http://securityfocus.com/bid/22224 · Nota
• http://drupal.org/node/112146 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-0505 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31729 · Nota
• http://vupen.com/english/advisories/2007/0312 · Nota
• http://secunia.com/advisories/23887 · Nota
• http://osvdb.org/32134 · Nota