CVE-2012-2670
CVSS V2 Medium 6.5
CVSS V3 None
Description
manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a direct request to the file in files/standard/avatar.
Overview
- CVE ID
- CVE-2012-2670
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Modified
- Published Version
- 2012-06-17T03:41:41
- Last Modified Date
- 2017-08-29T01:31:38
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:o-dyn:collabtive:*:*:*:*:*:*:*:* | 1 | OR | 0.7.5 | |
| cpe:2.3:a:o-dyn:collabtive:0.6.4:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:o-dyn:collabtive:0.6.5:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:o-dyn:collabtive:0.7:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:S/C:P/I:P/A:P
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- SINGLE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 6.5
- Severity
- MEDIUM
- Exploitability Score
- 8
- Impact Score
- 6.4
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2012-2670 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2670 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 08:49:43 | Added to TrackCVE |