PT-2008-1639 · Uber · Uber Uploader

Publicado 2008-01-08 · Atualizado 2018-10-15 · CVE-2007-6676

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Uber Uploader versions 5.3.6 and earlier

Description The default configuration of Uber Uploader does not block uploads of potentially dangerous file extensions, such as .html and .asp. This allows remote attackers to upload these files via API endpoints like "uu file upload.php" and "uber uploader file.php", which are related to "uu file upload.js" and "uber uploader file.js", respectively.

Recommendations For Uber Uploader versions 5.3.6 and earlier, consider adding restrictions to block uploads of potentially dangerous file extensions, such as .html and .asp, to prevent remote attackers from exploiting this issue. As a temporary workaround, restrict access to the "uu file upload.php" and "uber uploader file.php" API endpoints until a more permanent solution is implemented.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

CVE-2007-6676

Produtos afetados

Uber Uploader

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-6676 · Nota de Segurança
• http://securityreason.com/securityalert/3519 · Nota
• http://osvdb.org/43535 · Nota
• http://securityfocus.com/archive/1/485290/100/100/threaded · Nota
• http://securityfocus.com/archive/1/485235/100/100/threaded · Nota