Vulnerability in Dotclear
CVE-2011-1584
The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter. NOTE: some of these details are obtained from third party information.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.5 (Medium). Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.017 (76.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 76th percentile — 76.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.017 · newest: 0.017 · change: 0.000
Affected products
- Dotclear — versions 1.2.1, 1.2.2, 1.2.3
Weakness classification (CWE)
References
- openwall.com/lists/oss-security/2011/04/13/19 (mailing-list)
- openwall.com/lists/oss-security/2011/04/15/7 (mailing-list)
- openwall.com/lists/oss-security/2011/04/15/11 (mailing-list)
- fr.dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3 (Vendor Advisory)
- dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3 (Patch, Vendor Advisory)
- www.arcabit.com/english/home/a-flaw-in-dotclear
- dev.dotclear.org/2.0/changeset/2:3427 (Exploit, Patch)
- secunia.com/advisories/44049 (Vendor Advisory, third-party-advisory)
- openwall.com/lists/oss-security/2011/04/14/8 (mailing-list)