NVD

Id
50283  
Name
CVE-2009-3068  
Description
Unrestricted file upload vulnerability in the RoboHelpServer Servlet (robohelp/server) in Adobe RoboHelp Server 8 allows remote attackers to execute arbitrary code by uploading a Java Archive (.jsp) file during a PUBLISH action, then accessing it via a direct request to the file in the robohelp/robo/reserved/web directory under its sessionid subdirectory, as demonstrated by the vd_adobe module in VulnDisco Pack Professional 8.7 through 8.11.  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-09-04  
Modified Date
2013-07-17  
Seq
2009-3068  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
254496 50283 CVE-2009-3068 http://blogs.adobe.com/psirt/2009/09/potential_robohelp_server_8_is.html  View
254497 50283 CVE-2009-3068 http://intevydis.com/vd-list.shtml  View
254498 50283 CVE-2009-3068 http://twitter.com/elegerov/statuses/3727947465  View
254499 50283 CVE-2009-3068 http://twitter.com/elegerov/statuses/3737538715  View
254500 50283 CVE-2009-3068 http://twitter.com/elegerov/statuses/3737725344  View
254501 50283 CVE-2009-3068 http://www.adobe.com/support/security/bulletins/apsb09-14.html  View
254502 50283 CVE-2009-3068 http://www.intevydis.com/blog/?p=26  View
254503 50283 CVE-2009-3068 http://www.intevydis.com/blog/?p=69  View
254504 50283 CVE-2009-3068 20090923 ZDI-09-066: Adobe RoboHelp Server Arbitrary File Upload and Execute Vulnerability  View
254505 50283 CVE-2009-3068 36245  View
254506 50283 CVE-2009-3068 http://www.zerodayinitiative.com/advisories/ZDI-09-066  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41091 JVNDB-2009-002098 Adobe RoboHelp Server における任意のコードを実行される脆弱性 Adobe RoboHelp Server には、任意のコードを実行される脆弱性が存在します。 CVE-2009-3068 40499 CVE-2009-3068 50283 10 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002098.html 2009-09-09 2009-10-15 View