PT-2013-1824 · Drupal · Drupal

Forest Monsen · Publicado 2013-01-03 · Atualizado 2017-08-29 · CVE-2012-5653

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.27 Drupal versions 7.x before 7.18

Description The issue concerns the file upload feature, which allows remote authenticated users to bypass a protection mechanism. This can be achieved by including a null byte in a file name, enabling the execution of arbitrary PHP code.

Recommendations For versions 6.x before 6.27, update to version 6.27 or later. For versions 7.x before 7.18, update to version 7.18 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2012-5653

DSA-2776-1

Produtos afetados

Drupal

Referências · 11

• 🔥 http://drupalcode.org/project/drupal.git/commitdiff/b47f95d · Exploit
• 🔥 http://drupalcode.org/project/drupal.git/commitdiff/da8023a · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5653 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80795 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5653 · Nota de Segurança
• http://mandriva.com/security/advisories?name=MDVSA-2013:074 · Aviso do Fabricante
• http://osvdb.org/88529 · Nota
• http://debian.org/security/2013/dsa-2776 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/12/20/1 · Nota
• http://securityfocus.com/bid/56993 · Nota
• http://drupal.org/SA-CORE-2012-004 · Aviso do Fabricante