CVE-2012-2670
- State
- Published
- Severity
- Not scored
- Published
- Jun 17, 2012
- Updated
- Aug 6, 2024
- Reserved
- May 14, 2012
Description
manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a direct request to the file in files/standard/avatar.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 53813vdb-entry
- http://www.collabtive.o-dyn.de/blog/?p=426
- 20120604 Arbitrary File Upload/Execution in Collabtivemailing-list
- collabtive-manageuser-file-upload(76101)vdb-entry
- http://xync.org/2012/06/04/Arbitrary-File-Upload-in-Collabtive.html
- 20120605 Arbitrary File Upload/Execution in Collabtivemailing-list
- [oss-security] 20120606 Arbitrary File Upload/Execution in Collabtivemailing-list
- [oss-security] 20120606 Re: Arbitrary File Upload/Execution in Collabtivemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.