PT-2007-3949 · Fredck+1 · Ckeditor+1

Publicado 2007-05-11 · Atualizado 2018-10-16 · CVE-2007-2630

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ActiveCampaign 1-2-All (aka 12All) versions 4.50 through 4.53.13

Description The issue is related to an incomplete blacklist vulnerability in the FCKeditor module, specifically in the filemanager/browser/default/connectors/php/config.php file. This allows remote authenticated administrators to upload and possibly execute .php4 and .php5 files. The vulnerability can be reached through the filemanager/browser/default/browser.html file.

Recommendations For ActiveCampaign 1-2-All (aka 12All) versions 4.50 through 4.53.13, consider restricting access to the filemanager/browser/default/connectors/php/config.php file and the filemanager/browser/default/browser.html file to prevent potential exploitation. As a temporary workaround, consider disabling the upload functionality for .php4 and .php5 files in the FCKeditor module until a patch is available.

Correção

Identificadores relacionados

CVE-2007-2630

Produtos afetados

Activecampaign

Ckeditor

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/34049 · Nota
• http://activecampaign.com/support/forum/showthread.php?t=3293 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2007-2630 · Nota de Segurança
• http://securityfocus.com/bid/23792 · Nota
• http://securityfocus.com/archive/1/467483/100/0/threaded · Nota
• http://osvdb.org/36161 · Nota
• http://securityfocus.com/archive/1/467879/100/0/threaded · Nota
• https://osv.dev/vulnerability/CVE-2007-2630 · Aviso do Fabricante