PT-2014-6393 · X2Engine · X2Engine

Egidio Romano · Publicado 2014-10-10 · Atualizado 2018-10-09 · CVE-2014-5298

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions X2Engine versions 4.1.7 and earlier

Description The issue allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters. This is possible when running on case-insensitive file systems.

Recommendations For X2Engine versions 4.1.7 and earlier, consider implementing case-insensitive checks for executable extensions in the FileUploadsFilter.php to prevent bypassing the upload blacklist. As a temporary workaround, restrict access to file uploads until a proper fix is applied.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-5298

Produtos afetados

X2Engine

Referências · 7

• https://github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md · Nota
• http://seclists.org/fulldisclosure/2014/Sep/78 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5298 · Nota de Segurança
• http://packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html · Nota
• http://securityfocus.com/archive/1/533514/100/0/threaded · Nota
• http://karmainsecurity.com/KIS-2014-10 · Nota