PT-2009-6536 · Phpgroupware · Phpgroupware

Moritz Muehlenhoff

·

Publicado

2009-12-24

·

Atualizado

2017-08-17

·

CVE-2009-4415

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions phpGroupWare versions 0.9.16.12 through 0.9.16.013
Description The issue allows remote attackers to read arbitrary files or include and execute arbitrary local files. This can be achieved via the csvfile parameter to the "addressbook/csv import.php" endpoint, or the conv type parameter in "addressbook/inc/class.uiXport.inc.php".
Recommendations For phpGroupWare versions 0.9.16.12 through 0.9.16.013, consider restricting access to the "addressbook/csv import.php" and "addressbook/inc/class.uiXport.inc.php" files until a patch is available. As a temporary workaround, avoid using the csvfile and conv type parameters in the affected endpoints.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-4415
DSA-1978-1

Produtos afetados

Phpgroupware