PT-2013-2122 · Mutiny · Mutiny

Juan Vazquez + 1 · Published 2013-06-01 · Updated 2013-06-03 · CVE-2013-0136

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mutiny versions prior to 5.0-1.11

Description The issue allows remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service via multiple directory traversal vulnerabilities in the EditDocument servlet. This can be achieved through various parameters in different operations, including the uploadPath parameter in an UPLOAD operation, the paths[] parameter in DELETE, CUT, or COPY operations, or the newPath parameter in CUT or COPY operations.

Recommendations For Mutiny versions prior to 5.0-1.11, update to version 5.0-1.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the EditDocument servlet or limiting the allowed operations to prevent potential exploitation. Additionally, restrict the use of the uploadPath, paths[], and newPath parameters in the affected operations until the update is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-0136

Affected Products

Mutiny

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/mutiny_frontend_read_delete.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/mutiny_frontend_upload.rb · Exploit
• 🔥 https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/25517 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-0136 · Security Note
• http://kb.cert.org/vuls/id/701572 · Note