NVD

Id
8514  
Name
CVE-2011-1584  
Description
The updateFile function in inc/core/class.dc.media.php in the Media Manager in Dotclear before 2.2.3 does not properly restrict pathnames, which allows remote authenticated users to upload and execute arbitrary PHP code via the media_path or media_file parameter. NOTE: some of these details are obtained from third party information.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2011-06-08  
Modified Date
2012-04-27  
Seq
2011-1584  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
48953 8514 CVE-2011-1584 http://dev.dotclear.org/2.0/changeset/2:3427  View
48954 8514 CVE-2011-1584 http://dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3  View
48955 8514 CVE-2011-1584 http://fr.dotclear.org/blog/post/2011/04/01/Dotclear-2.2.3  View
48956 8514 CVE-2011-1584 [oss-security] 20110413 CVE request: dotclear before 2.2.3  View
48957 8514 CVE-2011-1584 [oss-security] 20110414 Re: CVE request: dotclear before 2.2.3  View
48958 8514 CVE-2011-1584 [oss-security] 20110415 Re: CVE request: dotclear before 2.2.3  View
48959 8514 CVE-2011-1584 [oss-security] 20110415 Re: CVE request: dotclear before 2.2.3  View
48960 8514 CVE-2011-1584 http://www.arcabit.com/english/home/a-flaw-in-dotclear  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34212 JVNDB-2011-004454 Dotclear の updateFile 関数における任意の PHP コードを実行される脆弱性 Dotclear の Media Manager の inc/core/class.dc.media.php の updateFile 関数は、パス名を制限しないため、任意の PHP コードを実行される脆弱性が存在します。 CVE-2011-1584 49491 CVE-2011-1584 8514 6.5 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004454.html 2011-06-08 2012-03-27 View