PT-2014-3573 · Pivotx · Pivotx

Diego García · Published 2014-04-15 · Updated 2014-04-15 · CVE-2014-0342

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PivotX versions prior to 2.3.9

Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .php or .php# extension. This can be achieved by accessing the uploaded file via unspecified vectors.

Recommendations For versions prior to 2.3.9, update to version 2.3.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the fileupload.php script to prevent unauthorized file uploads. Additionally, avoid using the file upload feature until the issue is resolved.

Fix

Related Identifiers

CVE-2014-0342

Affected Products

Pivotx

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-0342 · Security Note
• http://kb.cert.org/vuls/id/901156 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0342 · Note
• http://blog.pivotx.net/archive/2014/03/03/pivotx-239-released · Note
• http://pivotx.net/page/security · Note
• http://sourceforge.net/p/pivot-weblog/code/4347 · Note