PT-2008-1639 · Uber · Uber Uploader

Published 2008-01-08 · Updated 2018-10-15 · CVE-2007-6676

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Uber Uploader versions 5.3.6 and earlier

Description The default configuration of Uber Uploader does not block uploads of potentially dangerous file extensions, such as .html and .asp. This allows remote attackers to upload these files via API endpoints like "uu file upload.php" and "uber uploader file.php", which are related to "uu file upload.js" and "uber uploader file.js", respectively.

Recommendations For Uber Uploader versions 5.3.6 and earlier, consider adding restrictions to block uploads of potentially dangerous file extensions, such as .html and .asp, to prevent remote attackers from exploiting this issue. As a temporary workaround, restrict access to the "uu file upload.php" and "uber uploader file.php" API endpoints until a more permanent solution is implemented.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2007-6676

Affected Products

Uber Uploader

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-6676 · Security Note
• http://securityreason.com/securityalert/3519 · Note
• http://osvdb.org/43535 · Note
• http://securityfocus.com/archive/1/485290/100/100/threaded · Note
• http://securityfocus.com/archive/1/485235/100/100/threaded · Note