Vulnerability in Realpage Module Activex Controls

CVE-2010-2584

The Upload method in the RealPage Module Upload ActiveX control in Realpage.dll 1.0.0.9 in RealPage Module ActiveX Controls does not properly restrict certain property values, which allows remote attackers to read arbitrary files via a filename in the SourceFile property in conjunction with an http URL in the DestURL property.

EPSS: 0.014 (70.3th percentile) — read the EPSS interpretation.

Affected products

Realpage Module_activex_controls — versions 1.0.0.9
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_BID)
PSIRT-CNA@flexerasoftware.com (x_refsource_MISC, Vendor Advisory)
PSIRT-CNA@flexerasoftware.com (x_refsource_OSVDB, vdb-entry)