PT-2010-2803 · Oi · Oi.Blogs

Publicado 2010-03-23 · Atualizado 2010-03-24 · CVE-2010-1082

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OI.Blogs version 1.0.0

Description The issue allows remote attackers to read arbitrary files due to multiple directory traversal vulnerabilities. This occurs when the magic quotes gpc setting is disabled. The vulnerabilities are exploited through directory traversal sequences in the theme parameter to "loadStyles.php" and the scripts parameter to "javascript/loadScripts.php".

Recommendations For OI.Blogs version 1.0.0, consider disabling the loadStyles.php and javascript/loadScripts.php scripts until a patch is available, or enable the magic quotes gpc setting to prevent exploitation. Additionally, restrict access to the theme and scripts parameters to minimize the risk of arbitrary file reading.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-1082

Produtos afetados

Oi.Blogs

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2010-1082 · Nota de Segurança
• http://secunia.com/advisories/38726 · Aviso do Fabricante