VulnerabilityModified
CVE-2007-3163
Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2 allows remote attackers to upload arbitrary .php files via an alternate data stream syntax, as demonstrated by .php::$DATA filenames, a related issue to…
MEDIUM 5.0EPSS 1.51%
Does this matter?
Lower severity and a low EPSS score (1.51%). Track it; it rarely justifies an emergency change on its own.
Description
Incomplete blacklist vulnerability in the filemanager in Frederico Caldeira Knabben FCKeditor 2.4.2 allows remote attackers to upload arbitrary .php files via an alternate data stream syntax, as demonstrated by .php::$DATA filenames, a related issue to CVE-2006-0658.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 1.51% probability · 73th percentile
- CISA KEV
- Not listed
- Affected
- frederico caldeira knabben/fckeditor
- Source
- cve@mitre.org
References
- http://ha.ckers.org/blog/20070606/additional-image-bypass-on-windows/
- http://osvdb.org/37554
- http://secunia.com/advisories/25719
- http://secunia.com/advisories/25923
- http://sourceforge.net/project/shownotes.php?release_id=520159
- http://www.bitchiller.de/?p=20URL Repurposed
- http://www.securityfocus.com/bid/24510
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34982
- http://ha.ckers.org/blog/20070606/additional-image-bypass-on-windows/
- http://osvdb.org/37554
- http://secunia.com/advisories/25719
- http://secunia.com/advisories/25923
- http://sourceforge.net/project/shownotes.php?release_id=520159
- http://www.bitchiller.de/?p=20URL Repurposed
- http://www.securityfocus.com/bid/24510
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34982
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.