What is CVE-2013-4898?

CVE-2013-4898 is a vulnerability in Socialengine. Published 2014-01-29.

Is CVE-2013-4898 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Socialengine

CVE-2013-4898

Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in public/temporary/timeline/.

EPSS: 0.032 (86.6th percentile) — read the EPSS interpretation.

Affected products

Socialengine
Webhive Timeline — versions 4.2.5
N/a — versions n/a

Public proof-of-concept exploits

wesleyleite/CVE

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
cve@mitre.org (Exploit, exploit, x_refsource_EXPLOIT-DB)

Frequently asked questions

What is CVE-2013-4898?: CVE-2013-4898 is a vulnerability in Socialengine. Published 2014-01-29.
Is CVE-2013-4898 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.