Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2008-0577


Vulnerability Score 6.4 6.4
CVE Id CVE-2008-0577
Last Modified 07 Mar 2011 10:04:56
Published 04 Feb 2008 09:00:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE



The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of attached files when the Upload module is enabled for issue nodes, which allows remote attackers to upload and possibly execute arbitrary files; and (2) accepts the .html extension within the bundled file-upload functionality, which allows remote attackers to upload files containing arbitrary web script or HTML.

Vulnerable Systems


  • Drupal Project Issue Tracking Module 4.7

  • Drupal Project Issue Tracking Module 5.0


VUPEN - ADV-2008-0376

SECUNIA - 28731


Last Updated: 27 May 2016 10:46:52