CVE-2012-2670 File upload in n/a
Authenticated users can upload malicious files disguised as images to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-2670?
CVE-2012-2670 is a medium-severity vulnerability in n/a, published on 17 Jun 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a direct request to the file in files/standard/avatar.
Weakness: CWE-20
Which versions are affected by CVE-2012-2670?
It affects 1 product.
Products include O-Dyn Collabtive.
How do I fix CVE-2012-2670?
No fix has been published for CVE-2012-2670 yet. Limit exposure of the affected software until one is available.
Is CVE-2012-2670 being exploited?
There is no known exploitation of CVE-2012-2670 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5j3c-768x-m8c6.