Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-0577

Overview

Vulnerability Score 6.4 6.4
CVE Id CVE-2008-0577
Last Modified 07 Mar 2011 10:04:56
Published 04 Feb 2008 09:00:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2008-0577

Summary

The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of attached files when the Upload module is enabled for issue nodes, which allows remote attackers to upload and possibly execute arbitrary files; and (2) accepts the .html extension within the bundled file-upload functionality, which allows remote attackers to upload files containing arbitrary web script or HTML.

Vulnerable Systems

Application

  • Drupal Project Issue Tracking Module 4.7

  • Drupal Project Issue Tracking Module 5.0


References

VUPEN - ADV-2008-0376

SECUNIA - 28731

CONFIRM - http://drupal.org/node/216063


Last Updated: 27 May 2016 10:46:52