CVE-2008-3742

Drupal 5.x < 5.10 and 6.x < 6.4 - Authenticated Remote Code Execution via BlogAPI Module File Upload

Title source: llm
STIX 2.1

Description

Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated.

References (9)

Core 9
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=459108
Various Sources x_refsource_confirm
http://drupal.org/node/295053
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44447
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30689
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31825
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2392
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31462

Scores

EPSS 0.0287
EPSS Percentile 86.5%

Details

CWE
CWE-264
Status published
Products (14)
drupal/drupal 5.0
drupal/drupal 5.1
drupal/drupal 5.2
drupal/drupal 5.3
drupal/drupal 5.4
drupal/drupal 5.5
drupal/drupal 5.6
drupal/drupal 5.7
drupal/drupal 5.8
drupal/drupal 5.9
... and 4 more
Published Aug 27, 2008
Tracked Since Feb 18, 2026