CVE-2008-5905 The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via...
MediumCVSS 4.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The web interface plugin in KTorrent before 3.1.4 allows remote attackers to bypass intended access restrictions and upload arbitrary torrent files, and trigger the start of downloads and seeding, via a crafted HTTP POST request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ktorrent | <= 3.1.3 | No fix listed |
| ktorrent | = 0.9 | No fix listed |
| ktorrent | = 1.0 | No fix listed |
| ktorrent | = 1.1 | No fix listed |
| ktorrent | = 1.2 | No fix listed |
| ktorrent | = 1.2-rc1 | No fix listed |
| ktorrent | = 1.2-rc2 | No fix listed |
| ktorrent | = 2.0 | No fix listed |
| ktorrent | = 2.0-beta1 | No fix listed |
| ktorrent | = 2.0-rc1 | No fix listed |
| ktorrent | = 2.0.1 | No fix listed |
| ktorrent | = 2.0.2 | No fix listed |
| ktorrent | = 2.0.3 | No fix listed |
| ktorrent | = 2.1 | No fix listed |
| ktorrent | = 2.1-beta1 | No fix listed |
| ktorrent | = 2.1-rc1 | No fix listed |
| ktorrent | = 2.1.1 | No fix listed |
| ktorrent | = 2.1.2 | No fix listed |
| ktorrent | = 2.1.3 | No fix listed |
| ktorrent | = 2.1.4 | No fix listed |
| ktorrent | = 2.2 | No fix listed |
| ktorrent | = 2.2-beta1 | No fix listed |
| ktorrent | = 2.2-rc1 | No fix listed |
| ktorrent | = 2.2.1 | No fix listed |
| ktorrent | = 2.2.2 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ktorrent | = 2.2.3 | No fix listed |
| ktorrent | = 2.2.4 | No fix listed |
| ktorrent | = 2.2.5 | No fix listed |
| ktorrent | = 2.2.6 | No fix listed |
| ktorrent | = 2.2.7 | No fix listed |
| ktorrent | = 2.2.8 | No fix listed |
| ktorrent | = 3.0-beta1 | No fix listed |
| ktorrent | = 3.0-rc1 | No fix listed |
| ktorrent | = 3.0.0 | No fix listed |
| ktorrent | = 3.0.1 | No fix listed |
| ktorrent | = 3.0.2 | No fix listed |
| ktorrent | = 3.1.1 | No fix listed |
| ktorrent | = 3.1.2 | No fix listed |
| debian/ktorrent(Debian:12) | < 3.1.4+dfsg.1-1 | 3.1.4+dfsg.1-1 |
| debian/ktorrent(Debian:13) | < 3.1.4+dfsg.1-1 | 3.1.4+dfsg.1-1 |
| debian/ktorrent(Debian:14) | < 3.1.4+dfsg.1-1 | 3.1.4+dfsg.1-1 |
References
- bugs.debian.org
- ktorrent.org vendor-advisory
- [oss-security] 20090108 CVE request: ktorrent mailing-list
- 32442 third-party-advisory vendor-advisory
- 32447 third-party-advisory vendor-advisory
- 33675 third-party-advisory
- 34003 third-party-advisory
- GLSA-200902-05 vendor-advisory
- 31927 vdb-entry
- USN-711-1 vendor-advisory
- ADV-2008-2911 vdb-entry
- bugs.gentoo.org
- ktorrent-webinterface-weak-security(46117) vdb-entry
- Debian Security Tracker CVE-2008-5905 vendor-advisory