CVE-2011-1409 Auth bypass in n/a

Medium 5.0 Published 24 Jun 2011 Updated 6 Aug 2024

Remote attackers can bypass authentication and upload arbitrary files to the F*EX server by omitting the authentication ID.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-1409?

CVE-2011-1409 is a medium-severity authentication bypass vulnerability in n/a, published on 24 Jun 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID.

Weakness: CWE-287

Which versions are affected by CVE-2011-1409?

It affects 1 product.

Products include Ulli Horlacher Fex.

How do I fix CVE-2011-1409?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2011-1409 being exploited?

There is no known exploitation of CVE-2011-1409 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2011-1409, DSA-2259-1, GHSA-5p42-9ww9-5p77.