PT-2012-4170 · Collabtive · Collabtive

Mark Hoopes + 1 · Published 2012-06-17 · Updated 2017-08-29 · CVE-2012-2670

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Collabtive versions prior to 0.7.6

Description The issue allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions. This is achieved by uploading an avatar file with an accepted Content-Type, such as image/jpeg, and then accessing it via a direct request to the file in files/standard/avatar. This enables the upload and execution of arbitrary files.

Recommendations For versions prior to 0.7.6, update to version 0.7.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the manageuser.php file and the files/standard/avatar directory to minimize the risk of exploitation. Avoid using the manageuser.php file to upload avatar files until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2012-2670

Affected Products

Collabtive

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2012-2670 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76101 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2670 · Note
• http://xync.org/2012/06/04/Arbitrary-File-Upload-in-Collabtive.html · Note
• http://collabtive.o-dyn.de/blog/?p=426 · Note
• http://securityfocus.com/archive/1/522973/30/0/threaded · Note
• http://openwall.com/lists/oss-security/2012/06/06/6 · Note
• http://openwall.com/lists/oss-security/2012/06/06/9 · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-06/0007.html · Note
• http://securityfocus.com/bid/53813 · Note