« Volver al listado

CVE-2008-0569

Estado: ModificadaMedia (6.4)—

The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Drupal — Comment Upload Module

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-0569",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-02-05T02:00:00.000",
  "references": [
    {
      "url": "http://drupal.org/node/216024",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216035",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216036",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28729",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/27544",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0374/references",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216024",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/216035",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/216036",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28729",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27544",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0374/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El módulo Comment Upload 4.7.x antes de 4.7.x-0.1 y 5.x antes de 5.x-0.1 para Drupal no utiliza las funciones correctamente en el módulo upload (actualizar), que permite a atacantes remotos evitar la validación del upload y actualizar archivos arbitrarios y posiblemente ejecutar código arbitrario a través de vectores sin especificar."
    }
  ],
  "lastModified": "2026-06-16T22:49:53.730",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:comment_upload_module:4.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AE90D55-2062-4D8B-841B-B57EABF24B79"
            },
            {
              "criteria": "cpe:2.3:a:drupal:comment_upload_module:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "857EE6FC-1DF2-4DC7-BF8D-EE81B08E3FA7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}