PT-2008-4302 · Elinestudio · Elinestudio Site Composer

Publicado 2008-06-25 · Atualizado 2018-10-11 · CVE-2008-2863

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions eLineStudio Site Composer (ESC) version 2.6

Description The issue allows remote attackers to create or delete arbitrary directories due to absolute path traversal vulnerabilities. This can be achieved by providing a full pathname in the inpCurrFolder parameter to specific API endpoints, such as "/cms/assetmanager/folderdel .asp" or "/cms/assetmanager/foldernew.asp".

Recommendations For version 2.6, avoid using the inpCurrFolder parameter in the affected API endpoints until the issue is resolved. As a temporary workaround, consider restricting access to the "/cms/assetmanager/folderdel .asp" and "/cms/assetmanager/foldernew.asp" endpoints to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-2863

Produtos afetados

Elinestudio Site Composer

Referências · 8

• 🔥 http://securityfocus.com/bid/29812 · Exploit
• 🔥 https://exploit-db.com/exploits/5859 · Exploit
• 🔥 http://bugreport.ir/?/45 · Exploit
• http://securityfocus.com/archive/1/493473/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43193 · Nota
• http://securityreason.com/securityalert/3957 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2863 · Nota de Segurança
• http://secunia.com/advisories/30762 · Aviso do Fabricante