PT-2014-3573 · Pivotx · Pivotx

Diego García · Publicado 2014-04-15 · Atualizado 2014-04-15 · CVE-2014-0342

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.3.9

Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .php or .php# extension. This can be achieved by accessing the uploaded file via unspecified vectors.

Recommendations For versions prior to 2.3.9, update to version 2.3.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the fileupload.php script to prevent unauthorized file uploads. Additionally, avoid using the file upload feature until the issue is resolved.

Correção

Identificadores relacionados

CVE-2014-0342

Produtos afetados

Pivotx

Referências · 6

• http://kb.cert.org/vuls/id/901156 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0342 · Nota
• http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released · Nota
• http://pivotx.net/page/security · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0342 · Nota de Segurança
• http://sourceforge.net/p/pivot-weblog/code/4347 · Nota