PT-2007-6719 · Efileman · Efileman

Publicado 2007-10-30 · Atualizado 2018-10-15 · CVE-2007-5734

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions eFileMan versions 7.1.0.87 through 7.1.0.88

Description The issue allows remote attackers to upload arbitrary files. This is achieved by accessing the "upload.cgi" endpoint from "upload.html" with unspecified vectors, resulting in files being uploaded to the "uploads/upload file." destination.

Recommendations For versions 7.1.0.87 and 7.1.0.88, consider restricting access to the "upload.cgi" endpoint until a patch is available. As a temporary workaround, restrict the ability to upload files to the "uploads/upload file." destination to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-5734

Produtos afetados

Efileman

Referências · 5

• http://securityfocus.com/bid/26184 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5734 · Nota de Segurança
• http://securityreason.com/securityalert/3323 · Nota
• http://osvdb.org/39013 · Nota
• http://securityfocus.com/archive/1/482683/100/0/threaded · Nota