PT-2009-1125 · Fredck · Ckeditor

Vinny Guido

·

Published

2009-05-03

·

Updated

2024-01-10

·

CVE-2009-2265

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions FCKeditor versions prior to 2.6.4.1
Description The issue is related to multiple directory traversal vulnerabilities that allow remote attackers to create executable files in arbitrary directories. This is achieved through directory traversal sequences in the input to unspecified connector modules. The vulnerability is related to the file browser and the editor/filemanager/connectors/ directory. It has been exploited in the wild for remote code execution. The vulnerability is also associated with incorrect restriction of the path name to a directory with limited access, which may allow a remote attacker to upload arbitrary files.
Recommendations For FCKeditor versions prior to 2.6.4.1, update to version 2.6.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the file browser and the editor/filemanager/connectors/ directory to minimize the risk of exploitation. Avoid using the vulnerable connector modules until the issue is resolved.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-01042
CVE-2009-2265
DSA-1836-1

Affected Products

Ckeditor