PT-2002-2563 · Nola · Nola

Published 2002-12-31 · Updated 2024-01-26 · CVE-2002-1841

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions NOLA versions 1.1.1 through 1.1.2

Description The document management module does not restrict the types of files that are uploaded, allowing remote attackers to upload and execute arbitrary PHP files with extensions such as .php4.

Recommendations For versions 1.1.1 and 1.1.2, restrict the types of files that can be uploaded to the document management module to prevent the execution of arbitrary PHP files. As a temporary workaround, consider disabling the file upload feature in the document management module until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2002-1841

Affected Products

Nola

References · 7

• http://securityfocus.com/bid/5116 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-1841 · Security Note
• http://online.securityfocus.com/archive/1/280340 · Note
• http://iss.net/security_center/static/9438.php · Note
• https://t.me/cvenotify/68956 · Telegram Post
• http://marc.info/?l=vuln-dev&m=102520790718208&w=2 · Note
• http://marc.info/?l=vuln-dev&m=102511114021370&w=2 · Note