PT-2013-5028 · Simple Machines · Simple Machines Forum

Henryhoggard · Published 2013-10-25 · Updated 2013-10-28 · CVE-2013-4465

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:N/AC:H/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Simple Machines Forum versions prior to 2.0.6 Simple Machines Forum versions prior to 2.1

Description The issue is related to an unrestricted file upload vulnerability in the avatar upload functionality. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request to the file.

Recommendations For versions prior to 2.0.6, update to version 2.0.6 or later to resolve the issue. For versions prior to 2.1, update to version 2.1 or later to resolve the issue.

Fix

Related Identifiers

CVE-2013-4465

Affected Products

Simple Machines Forum

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-4465 · Security Note
• https://github.com/SimpleMachines/SMF2.1/issues/701 · Note
• http://openwall.com/lists/oss-security/2013/10/25/3 · Note
• http://openwall.com/lists/oss-security/2013/10/23/6 · Note
• http://securityfocus.com/bid/63275 · Note
• http://download.simplemachines.org/index.php?thanks%3Bfilename=smf_2-0-6_changelog.txt · Note