PT-2014-5497 · Dotclear · Dotclear

Egidio Romano · Publicado 2014-06-11 · Atualizado 2014-06-12 · CVE-2014-3782

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dotclear versions prior to 2.6.3

Description The issue is related to incomplete blacklist vulnerabilities in the filemanager::isFileExclude method within the Media Manager. This allows remote authenticated users to execute arbitrary PHP code by uploading files with specific extensions, such as double extensions or certain PHP file extensions like .php5 or .phtml.

Recommendations For versions prior to 2.6.3, update to version 2.6.3 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary and validated extensions to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2014-3782

Produtos afetados

Dotclear

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2014-3782 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/May/116 · Nota
• http://seclists.org/fulldisclosure/2014/May/108 · Nota
• http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3 · Aviso do Fabricante
• http://secunia.com/advisories/58675 · Nota
• http://karmainsecurity.com/KIS-2014-06 · Nota
• http://seclists.org/fulldisclosure/2014/May/122 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3782 · Nota