PT-2009-3348 · Page Engine · Page Engine Cms

Publicado 2009-02-24 · Atualizado 2017-08-17 · CVE-2009-0729

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Page Engine CMS versions 2.0 Basic and Pro

Description The issue allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to various API endpoints, including (1) "modules/recent poll include.php", (2) "modules/login include.php", (3) "modules/statistics include.php", and (4) "configuration.inc.php" in "includes/".

Recommendations For Page Engine CMS version 2.0 Basic, restrict access to the vulnerable modules and files until a patch is available. For Page Engine CMS version 2.0 Pro, avoid using the fPrefix parameter in the affected API endpoints until the issue is resolved. As a temporary workaround, consider disabling the execution of arbitrary local files via directory traversal sequences in the affected modules and files.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-0729

Produtos afetados

Page Engine Cms

Referências · 8

• http://osvdb.org/52177 · Nota
• http://secunia.com/advisories/33983 · Aviso do Fabricante
• http://osvdb.org/52178 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48856 · Nota
• http://osvdb.org/52175 · Nota
• http://securityfocus.com/bid/33860 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0729 · Nota de Segurança
• http://osvdb.org/52176 · Nota