CVE-2015-0258 Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a fi...
HighCVSS 8.8
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| o-dyn collabtive | < 2.1 | 2.1 |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- github.com patch third-party-advisory
- [debian-lts-announce] 20200228 [SECURITY] [DLA 2125-1] collabtive security update mailing-list third-party-advisory
- USN-4590-1 third-party-advisory vendor-advisory