« Volver al listado

CVE-2008-3232

Estado: ModificadaAlta (9.3)—

Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dotclear — Dotclear

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-3232",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-07-18T16:41:00.000",
  "references": [
    {
      "url": "http://osvdb.org/44441",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/29819",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.dotclear.net/blog/post/2008/04/18/Dotclear-128",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.dotclear.net/blog/post/2008/04/18/Gestionnaire-de-media-et-types-de-fichiers",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2008/07/14/2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/490865/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/28787",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41828",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44039",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/44441",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/29819",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.dotclear.net/blog/post/2008/04/18/Dotclear-128",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.dotclear.net/blog/post/2008/04/18/Gestionnaire-de-media-et-types-de-fichiers",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2008/07/14/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/490865/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/28787",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41828",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44039",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        },
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad sin especificar en versiones de dotclear anteriores a 1.2.8 tiene un impacto desconocido y vectores de ataque relacionados con la falta de un parche para una vulnerabilidad de subida de imágenes a servidor."
    }
  ],
  "lastModified": "2026-06-16T22:55:25.887",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC570796-5E0E-495E-8758-F80ADD44EBD9",
              "versionEndIncluding": "1.2.7"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:1.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94896556-5D43-4C54-A49C-301511B69EB4"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:1.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE7B92DB-62E4-4F4F-BC57-2C5F646C13CD"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:1.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49EEF727-A23D-47AE-BE4E-238290246BE5"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:1.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "860F6A6A-717B-4B94-B4D0-26C2BAC1E66D"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:1.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9ED66191-F39E-4D78-9B3D-1A20FD2914B8"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:1.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AFFAE76-D4DE-4F4C-B165-736EA01B30EC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}