PT-2007-4446 · Freddie Chung · Ckeditor

Published 2007-06-11 · Updated 2024-02-14 · CVE-2007-3163

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: FCKeditor version 2.4.2

Description: The issue is related to an incomplete blacklist vulnerability in the filemanager component. This allows remote attackers to upload arbitrary .php files using an alternate data stream syntax, such as .php::$DATA filenames.

Recommendations: For version 2.4.2, consider restricting the upload of .php files to prevent exploitation until a patch is available. As a temporary workaround, restrict access to the filemanager component to minimize the risk of uploading malicious files.

Fix

Related Identifiers

CVE-2007-3163

Affected Products

Ckeditor

References · 10

• https://osv.dev/vulnerability/CVE-2007-3163 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3163 · Security Note
• http://securityfocus.com/bid/24510 · Note
• http://bitchiller.de/?p=20 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34982 · Note
• http://secunia.com/advisories/25719 · Note
• http://osvdb.org/37554 · Note
• http://ha.ckers.org/blog/20070606/additional-image-bypass-on-windows · Note
• http://sourceforge.net/project/shownotes.php?release_id=520159 · Note
• http://secunia.com/advisories/25923 · Note