CVE-2008-0577 File upload in n/a
Remote attackers can upload malicious files to execute code or inject scripts if the Upload module is enabled for issue nodes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2008-0577?
CVE-2008-0577 is a medium-severity vulnerability in n/a, published on 5 Feb 2008. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of attached files when the Upload module is enabled for issue nodes, which allows remote attackers to upload and possibly execute arbitrary files; and (2) accepts the .html extension within the bundled file-upload functionality, which allows remote attackers to upload files containing arbitrary web script or HTML.
Weakness: CWE-264
Which versions are affected by CVE-2008-0577?
It affects 1 product.
Products include Drupal Project Issue Tracking Module.
How do I fix CVE-2008-0577?
No fix has been published for CVE-2008-0577 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-0577 being exploited?
There is no known exploitation of CVE-2008-0577 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5prg-69vq-2qg9.