PT-2008-4718 · Lemon+1 · Emoncms+1

Publicado 2008-07-25 · Atualizado 2017-08-08 · CVE-2008-3312

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Lemon CMS version 1.10

Description: A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the dir parameter in the browser.php file of the FCKeditor component. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations: For Lemon CMS version 1.10, consider restricting access to the browser.php file in the FCKeditor component to minimize the risk of exploitation. Avoid using the dir parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3312

Produtos afetados

Ckeditor

Emoncms

Referências · 5

• 🔥 http://securityfocus.com/bid/30285/exploit · Exploit
• 🔥 https://exploit-db.com/exploits/32081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3312 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43907 · Nota
• http://securityfocus.com/bid/30285 · Nota