PT-2010-5388 · Joomla · Nbill

Publicado 2010-11-16 · Atualizado 2010-11-17 · CVE-2010-4270

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions nBill (com netinvoice) versions prior to 2.0.9 standard edition nBill (com netinvoice) versions prior to 2.0.10 lite edition nBill (com netinvoice) version 1.2 10 for Joomla

Description The issue allows remote attackers to read arbitrary files via directory traversal sequences in unspecified vectors related to API endpoints such as "administrator/components/com nbill/admin.nbill.php", "components/com nbill/nbill.php", "administrator/components/com netinvoice/admin.netinvoice.php", or "components/com netinvoice/netinvoice.php". This has been exploited in the wild.

Recommendations For nBill (com netinvoice) versions prior to 2.0.9 standard edition, update to version 2.0.9 or later. For nBill (com netinvoice) versions prior to 2.0.10 lite edition, update to version 2.0.10 or later. For nBill (com netinvoice) version 1.2 10 for Joomla, update to a version later than 1.2 10. As a temporary workaround, consider restricting access to the affected API endpoints until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-4270

Produtos afetados

Nbill

Referências · 6

• http://secunia.com/advisories/42186 · Aviso do Fabricante
• http://securityfocus.com/bid/44719 · Nota
• http://nbill.co.uk/newsflash/security-patch-for-all-versions-of-nbill.html · Aviso do Fabricante
• http://osvdb.org/69066 · Nota
• http://nbill.co.uk/forum-smf/index.php/topic%2C2158.0.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-4270 · Nota de Segurança