VulnerabilityModified
CVE-2006-7080
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter.
MEDIUM 4.3EPSS 4.49%
Does this matter?
Lower severity and a low EPSS score (4.49%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in the avatar upload feature in exV2 2.0.4.3 and earlier allows remote attackers to delete arbitrary files via ".." sequences in the old_avatar parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 4.49% probability · 91th percentile
- CISA KEV
- Not listed
- Affected
- exv2/content management system
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/20161Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29130
- https://www.exploit-db.com/exploits/2415
- http://www.securityfocus.com/bid/20161Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29130
- https://www.exploit-db.com/exploits/2415
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.