PT-2008-4718 · Lemon+1 · Emoncms+1

Published 2008-07-25 · Updated 2017-08-08 · CVE-2008-3312

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Lemon CMS version 1.10

Description: A directory traversal issue exists, allowing remote attackers to include and execute arbitrary local files. This is achieved by using a .. (dot dot) in the dir parameter in the browser.php file of the FCKeditor component. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations: For Lemon CMS version 1.10, consider restricting access to the browser.php file in the FCKeditor component to minimize the risk of exploitation. Avoid using the dir parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2008-3312

Affected Products

Ckeditor

Emoncms

References · 5

• 🔥 http://securityfocus.com/bid/30285/exploit · Exploit
• 🔥 https://exploit-db.com/exploits/32081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-3312 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43907 · Note
• http://securityfocus.com/bid/30285 · Note