PT-2014-6393 · X2Engine · X2Engine

Egidio Romano · Published 2014-10-10 · Updated 2018-10-09 · CVE-2014-5298

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions X2Engine versions 4.1.7 and earlier

Description The issue allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters. This is possible when running on case-insensitive file systems.

Recommendations For X2Engine versions 4.1.7 and earlier, consider implementing case-insensitive checks for executable extensions in the FileUploadsFilter.php to prevent bypassing the upload blacklist. As a temporary workaround, restrict access to file uploads until a proper fix is applied.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-5298

Affected Products

X2Engine

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-5298 · Security Note
• https://github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md · Note
• http://seclists.org/fulldisclosure/2014/Sep/78 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf · Note
• http://packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html · Note
• http://securityfocus.com/archive/1/533514/100/0/threaded · Note
• http://karmainsecurity.com/KIS-2014-10 · Note