PT-2014-2189 · Gilles Lamiral · Domain Technologie Control

Ansgar Burchardt

·

Publicado

2014-03-20

·

Atualizado

2014-03-21

·

CVE-2011-5273

CVSS v2.0

6.5

Média

VetorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Domain Technologie Control (DTC) versions prior to 0.34.1
Description A directory traversal issue exists, allowing remote authenticated users to execute arbitrary PHP code. This is achieved by including a .. (dot dot) in the pkg parameter within a do install action to dtc/.
Recommendations For versions prior to 0.34.1, update to version 0.34.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the do install action or validating the pkg parameter to prevent directory traversal attacks.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2011-5273

Produtos afetados

Domain Technologie Control