« Volver al listado

CVE-2010-0993

Estado: ModificadaMedia (6)—

Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pulsecms — Pulse CMS

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0993",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT-CNA@flexerasoftware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-04-09T17:30:00.350",
  "references": [
    {
      "url": "http://pulsecms.com/blog.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/advisories/39046",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/secunia_research/2010-47/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/510617/100/0/threaded",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://pulsecms.com/blog.php",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/39046",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/secunia_research/2010-47/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/510617/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in Pulse CMS Basic 1.2.2 and 1.2.3, and possibly Pulse Pro before 1.3.2, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de subida de fichero sin restricción en Pulse CMS Basic v1.2.2 y v1.2.3, probablemente Pulse Pro anterior v1.3.2, permite a usuarios utentificados remotamente ejecutar código de su elección a través de la carga de un fichero con extensión ejecutable, y luego acceder a él mediante una petición directa en un directorio no especificado."
    }
  ],
  "lastModified": "2026-06-16T23:17:16.533",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pulsecms:pulse_cms:1.2.2:-:basic:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49648AF1-DAD8-44C6-BEDF-8F19DF180E8B"
            },
            {
              "criteria": "cpe:2.3:a:pulsecms:pulse_cms:1.2.3:-:basic:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6902B6AA-D3A3-4453-B3C5-16DE2EB660CC"
            },
            {
              "criteria": "cpe:2.3:a:pulsecms:pulse_cms:1.3.2:-:pro:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFA8814A-69C9-48B4-B8BB-3265C7058A8D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/434.html\r\n\r\n'Unrestricted Upload of File with Dangerous Type'",
  "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}