CVE-2008-0577

Drupal Project Issue Tracking Module File Upload/Execution Vulnerability

Title source: llm

Description

The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal (1) does not restrict the extensions of attached files when the Upload module is enabled for issue nodes, which allows remote attackers to upload and possibly execute arbitrary files; and (2) accepts the .html extension within the bundled file-upload functionality, which allows remote attackers to upload files containing arbitrary web script or HTML.

References (3)

Core 3

Core References

Various Sources x_refsource_confirm

http://drupal.org/node/216063

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/28731

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/0376/references

Scores

EPSS 0.0028

EPSS Percentile 51.1%

Details

CWE

CWE-264

Status published

Products (2)

drupal/project_issue_tracking_module 4.7

drupal/project_issue_tracking_module 5.0

Published Feb 05, 2008

Tracked Since Feb 18, 2026