PT-2008-4787 · Interact Learning Community Environment · Interact

Publicado 2008-07-30 · Atualizado 2018-10-11 · CVE-2008-3384

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Interact Learning Community Environment Interact version 2.4.1

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to include and execute arbitrary local files. The attack can be performed by using a .. (dot dot) in the module and file parameters.

Recommendations For Interact Learning Community Environment Interact version 2.4.1, consider restricting access to the help/help.php file until a patch is available. As a temporary workaround, avoid using the module and file parameters in the help/help.php file to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2008-3384

Produtos afetados

Interact

Referências · 9

• 🔥 http://securityfocus.com/bid/30315 · Exploit
• 🔥 https://exploit-db.com/exploits/6107 · Exploit
• http://securityfocus.com/archive/1/494582/100/0/threaded · Nota
• http://securityreason.com/securityalert/4073 · Nota
• http://vupen.com/english/advisories/2008/2155/references · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3384 · Nota de Segurança
• http://secunia.com/advisories/31150 · Aviso do Fabricante
• http://sourceforge.net/forum/forum.php?thread_id=2104908&forum_id=237160 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43937 · Nota