PT-2010-2180 · Phpgroupware · Phpgroupware

Publicado

2010-05-18

·

Atualizado

2018-10-10

·

CVE-2010-0403

CVSS v2.0

6.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions phpGroupWare (phpgw) versions prior to 0.9.16.016
Description The issue allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the app parameter of the about.php file. This is a directory traversal vulnerability.
Recommendations For versions prior to 0.9.16.016, update to version 0.9.16.016 or later to resolve the issue. As a temporary workaround, consider restricting access to the about.php file until a patch is applied. Avoid using the app parameter in the about.php file with untrusted input until the issue is resolved.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-0403
DSA-2046-1

Produtos afetados

Phpgroupware