PT-2020-7617 · United Planet · Intrexx Professional

Published 2020-01-31 · Updated 2020-02-13 · CVE-2014-2025

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions United Planet Intrexx Professional versions prior to 5.2 Online Update 0905 United Planet Intrexx Professional versions 6.x prior to 6.0 Online Update 10

Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension. This is made possible by an unrestricted file upload vulnerability in an unspecified third-party tool.

Recommendations For versions prior to 5.2 Online Update 0905, update to version 5.2 Online Update 0905 or later. For versions 6.x prior to 6.0 Online Update 10, update to version 6.0 Online Update 10 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2014-2025

Affected Products

Intrexx Professional

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-2025 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99568 · Note
• http://christian-schneider.net/advisories/CVE-2014-2025.txt · Note
• https://help.unitedplanet.com/?rq_AppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_TargetPageGuid=2EBBF802B1970FE31EFC8A34108DF3F47E7A8EEC&rq_RecId=31&rq_SourceAppGuid=C203A277EDDF9AD2492B776B996B20D4A7C58395&rq_SourcePageGuid=7A91F4B76FFC41A18F4EA4ACE26F31E033C5B018&rq_SourceRecId=31 · Note