NVD

Id
10632  
Name
CVE-2011-4106  
Description
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2013-10-26  
Modified Date
2013-10-28  
Seq
2011-4106  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
60087 10632 CVE-2011-4106 http://code.google.com/p/timthumb/issues/detail?id=212  View
60088 10632 CVE-2011-4106 http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/  View
60089 10632 CVE-2011-4106 http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/  View
60090 10632 CVE-2011-4106 http://www.binarymoon.co.uk/2011/08/timthumb-2/  View
60091 10632 CVE-2011-4106 17602  View
60092 10632 CVE-2011-4106 17872  View
60093 10632 CVE-2011-4106 [oss-security] 20111103 Re: CVE request: wordpress plugin timthumb before 2.0 remote code execution  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
35005 JVNDB-2011-005247 TimThumb における任意のコードをアップロードされる脆弱性 TimThumb (timthumb.php) は、ドメインホワイトリストの全ソースを検証しないため、任意のコードをアップロードされ、実行される脆弱性が存在します。 CVE-2011-4106 52013 CVE-2011-4106 10632 6.8 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-005247.html 2011-08-01 2013-10-29 View