CVE-2013-5576 administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended a...
MediumCVSS 6.8
EPSS 48.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended access restrictions and upload files with dangerous extensions via a filename with a trailing . (dot), as exploited in the wild in August 2013.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| joomla | = 2.5.0 | No fix listed |
| joomla | = 2.5.1 | No fix listed |
| joomla | = 2.5.2 | No fix listed |
| joomla | = 2.5.3 | No fix listed |
| joomla | = 2.5.4 | No fix listed |
| joomla | = 2.5.5 | No fix listed |
| joomla | = 2.5.6 | No fix listed |
| joomla | = 2.5.7 | No fix listed |
| joomla | = 2.5.8 | No fix listed |
| joomla | = 2.5.9 | No fix listed |
| joomla | = 2.5.10 | No fix listed |
| joomla | = 2.5.11 | No fix listed |
| joomla | = 2.5.12 | No fix listed |
| joomla | = 2.5.13 | No fix listed |
| joomla | = 3.0.0 | No fix listed |
| joomla | = 3.0.1 | No fix listed |
| joomla | = 3.0.2 | No fix listed |
| joomla | = 3.0.3 | No fix listed |
| joomla | = 3.0.4 | No fix listed |
| joomla | = 3.1.0 | No fix listed |
| joomla | = 3.1.1 | No fix listed |
| joomla | = 3.1.2 | No fix listed |
| joomla | = 3.1.3 | No fix listed |
| joomla | = 3.1.4 | No fix listed |
References
- developer.joomla.org
- joomlacode.org
- [oss-security] 20130824 CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 mailing-list
- [oss-security] 20130824 Re: CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 mailing-list
- www.cso.com.au
- 27610 exploit
- VU#639620 third-party-advisory us-government-resource
- github.com
- github.com exploit patch