PT-2011-2553 · Lomtec · Lomtec Activeweb Professional

Stenoplasma · Publicado 2011-01-28 · Atualizado 2017-08-17 · CVE-2011-0678

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lomtec ActiveWeb Professional version 3.0

Description The issue concerns an unrestricted file upload vulnerability in the EasyEdit module. This allows remote attackers to execute arbitrary code by uploading an executable file. The vulnerability is exploited through the UploadDirectory and Accepted Extensions fields in the getImagefile component of EasyEdit.cfm.

Recommendations For Lomtec ActiveWeb Professional version 3.0, restrict access to the UploadDirectory field and limit the Accepted Extensions in the getImagefile component of EasyEdit.cfm to prevent uploading of executable files. Consider disabling the EasyEdit module until a proper fix is available.

Exploit

Correção

Identificadores relacionados

CVE-2011-0678

Produtos afetados

Lomtec Activeweb Professional

Referências · 9

• 🔥 http://securityfocus.com/bid/45985 · Exploit
• 🔥 http://exploitdevelopment.com/Vulnerabilities/2010-WEB-002.html · Exploit
• 🔥 https://exploit-db.com/exploits/35256 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0678 · Nota de Segurança
• http://vupen.com/english/advisories/2011/0217 · Nota
• http://kb.cert.org/vuls/id/528212 · Nota
• http://secunia.com/advisories/43031 · Nota
• http://osvdb.org/70669 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65013 · Nota