CVE-2007-0147

CVE-2007-0147

EPSS 1.2%

Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles.

Affected products

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://cuyahoga.svn.sourceforge.net/viewvc/cuyahoga?view=rev&revision=551 http://osvdb.org/32643 http://secunia.com/advisories/23662 http://www.cuyahoga-project.org/10/section.aspx/61 http://www.securityfocus.com/bid/21927