CVE-2008-0569

The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://drupal.org/node/216024
http://drupal.org/node/216035
http://drupal.org/node/216036
http://secunia.com/advisories/28729	Vendor Advisory
http://www.securityfocus.com/bid/27544
http://www.vupen.com/english/advisories/2008/0374/references

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drupal:comment_upload_module:4.7:::::::*
	cpe:2.3:a:drupal:comment_upload_module:5.0:::::::*

History

No history.

Information

Published : 2008-02-05 02:00

Updated : 2024-02-04 17:13

NVD link : CVE-2008-0569

Mitre link : CVE-2008-0569

CVE.ORG link : CVE-2008-0569

JSON object : View

Products Affected

drupal

comment_upload_module

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2008-0569", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2008-02-05T02:00:00.000", "references": [{"url": "http://drupal.org/node/216024", "source": "cve@mitre.org"}, {"url": "http://drupal.org/node/216035", "source": "cve@mitre.org"}, {"url": "http://drupal.org/node/216036", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/28729", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/27544", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/0374/references", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors."}, {"lang": "es", "value": "El m\u00f3dulo Comment Upload 4.7.x antes de 4.7.x-0.1 y 5.x antes de 5.x-0.1 para Drupal no utiliza las funciones correctamente en el m\u00f3dulo upload (actualizar), que permite a atacantes remotos evitar la validaci\u00f3n del upload y actualizar archivos arbitrarios y posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores sin especificar."}], "lastModified": "2011-03-08T03:04:55.877", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:comment_upload_module:4.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3AE90D55-2062-4D8B-841B-B57EABF24B79"}, {"criteria": "cpe:2.3:a:drupal:comment_upload_module:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "857EE6FC-1DF2-4DC7-BF8D-EE81B08E3FA7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}