« Volver al listado

CVE-2014-3782

Estado: ModificadaMedia (6)—

Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dotclear — Dotclear

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-3782",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-06-11T14:55:08.067",
  "references": [
    {
      "url": "http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://karmainsecurity.com/KIS-2014-06",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/May/108",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/May/116",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/May/122",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/58675",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://dotclear.org/blog/post/2014/05/16/Dotclear-2.6.3",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://karmainsecurity.com/KIS-2014-06",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/May/108",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/May/116",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/May/122",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/58675",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple incomplete blacklist vulnerabilities in the filemanager::isFileExclude method in the Media Manager in Dotclear before 2.6.3 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) double extension or (2) .php5, (3) .phtml, or some other PHP file extension."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de lista negra incompleta en el método filemanager::isFileExclude en Media Manager en Dotclear anterior a 2.6.3 permiten a usuarios remotos autenticados ejecutar código PHP arbitrario mediante la subida de un archivo con (1) una extensión doble o (2) .php5, (3) .phtml, o alguna otra extensión de archivo PHP."
    }
  ],
  "lastModified": "2026-06-17T00:08:52.657",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E98CC15-9275-4BED-AA21-B874AB4E2582",
              "versionEndIncluding": "2.6.2"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:2.6:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00CD117F-2953-48C9-9E10-096313C5E997"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:2.6:rc:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59242804-8E33-48DC-9D67-DF5BFC578A2C"
            },
            {
              "criteria": "cpe:2.3:a:dotclear:dotclear:2.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37865F5D-D647-4CE8-8BE2-9C650941A6EE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/184.html\n\n\"CWE-184: Incomplete Blacklist\"",
  "sourceIdentifier": "cve@mitre.org"
}