PT-2006-3476 · Ckeditor · Ckeditor

Published 2006-05-22 · Updated 2011-03-08 · CVE-2006-2529

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FCKeditor versions prior to 2.3 Beta

Description The issue concerns the upload feature in FCKeditor, where the Type parameter is not properly verified, allowing remote attackers to upload arbitrary file types.

Recommendations For versions prior to 2.3 Beta, consider disabling the upload feature until a patch is available. Restrict access to the upload.php file in the editor/filemanager/upload/php directory to minimize the risk of exploitation. Avoid using the Type parameter in the affected upload functionality until the issue is resolved.

Fix

Related Identifiers

CVE-2006-2529

Affected Products

Ckeditor

References · 7

• http://fckeditor.net/whatsnew/default.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-2529 · Security Note
• http://securityfocus.com/bid/18029 · Patch
• http://secunia.com/advisories/20122 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1856 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2529 · Note
• http://osvdb.org/25631 · Note