CVE

Id
70383  
CVE No.
CVE-2014-3088  
Status
Candidate  
Description
stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as demonstrated by replacing a text/plain .txt upload with an application/octet-stream .exe upload.  
Phase
Assigned (20140429)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
669704 70383 CVE-2014-3088 MISC:http://packetstormsecurity.com/files/127294  View
669705 70383 CVE-2014-3088 MISC:http://packetstormsecurity.com/files/127829/IBM-Sametime-Meet-Server-8.5-Arbitrary-File-Upload.html  View
669706 70383 CVE-2014-3088 CONFIRM:http://linux.oracle.com/errata/ELSA-2014-0747.html  View
669707 70383 CVE-2014-3088 BID:68291  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
18704 JVNDB-2014-007579 IBM Curam Social Program Management におけるクロスサイトスクリプティングの脆弱性 IBM Curam Social Program Management には、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2014-3096 70383 3.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007579.html  View