NVD

Id
31352  
Name
CVE-2014-3088  
Description
stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as demonstrated by replacing a text/plain .txt upload with an application/octet-stream .exe upload.  
Reject
 
CVSS Version
2  
CVSS Score
5.5  
Severity
Medium  
CVSS Base Score
5.5  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:N)  
Pub Date
2017-01-19  
Published
2014-07-01  
Modified Date
2017-01-06  
Seq
2014-3088  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
164168 31352 CVE-2014-3088 http://linux.oracle.com/errata/ELSA-2014-0747.html  View
164169 31352 CVE-2014-3088 http://packetstormsecurity.com/files/127294  View
164170 31352 CVE-2014-3088 http://packetstormsecurity.com/files/127829/IBM-Sametime-Meet-Server-8.5-Arbitrary-File-Upload.html  View
164171 31352 CVE-2014-3088 68291  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14250 JVNDB-2014-003125 IBM Sametime Meeting Server の stconf.nsf におけるアップロードの制限を回避される脆弱性 IBM Sametime Meeting Server の stconf.nsf は、wAttach?OpenForm multipart/form-data POST リクエストで使用されるファイル形式を検証する際にクライアントに依存しているため、アップロードの制限を回避される脆弱性が存在します。 CVE-2014-3088 70375 CVE-2014-3088 31352 5.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003125.html 2014-07-01 2014-07-04 View