CVE-2008-6658

Опубликовано: 07 апр. 2009

Источник: nvd

CVSS2: 4

EPSS Низкий

Описание

Directory traversal vulnerability in index.php in Simple Machines Forum (SMF) 1.0 before 1.0.15 and 1.1 before 1.1.7 allows remote authenticated administrators to install packages from arbitrary directories via a .. (dot dot) in the package parameter during an install2 action, as demonstrated by a predictable package filename in attachments/ that was uploaded through a post2 action to index.php.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:simple_machines:simple_machines_forum:1.0.5:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.0.6:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.0.7:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.0.11:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.0.12:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1.1:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1.2:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1.3:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1.4:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1.5:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1.6:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc1:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc2:*:*:*:*:*:*:*

cpe:2.3:a:simple_machines:simple_machines_forum:1.1_rc3:*:*:*:*:*:*:*

EPSS

Процентиль: 85%

0.02383

Низкий

4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

GHSA-4j9j-5w9g-5f4f

github

больше 3 лет назад