« Volver al listado

CVE-2014-5298

Estado: ModificadaMedia (5)—

FileUploadsFilter.php en X2Engine 4.1.7 y anteriores, cuando funciona en sistemas de ficheros insensibles a mayúsculas y minúsculas, permite a atacantes remotos evadir la lista negra de subidas y realizar ataques de subidas de ficheros no restringidos mediante la subida de un fichero con una extensión ejecutable que contiene letras mayúsculas, tal y como fue demostrado al utilizar un programa PHP.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

X2engine — X2engine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-5298",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-10-10T01:55:11.210",
  "references": [
    {
      "url": "http://karmainsecurity.com/KIS-2014-10",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Sep/78",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533514/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://karmainsecurity.com/KIS-2014-10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://packetstormsecurity.com/files/128353/X2Engine-4.1.7-Unrestricted-File-Upload.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2014/Sep/78",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/533514/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-234763.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/X2Engine/X2Engine/blob/master/CHANGELOG.md",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "FileUploadsFilter.php in X2Engine 4.1.7 and earlier, when running on case-insensitive file systems, allows remote attackers to bypass the upload blacklist and conduct unrestricted file upload attacks by uploading a file with an executable extension that contains uppercase letters, as demonstrated using a PHP program."
    },
    {
      "lang": "es",
      "value": "FileUploadsFilter.php en X2Engine 4.1.7 y anteriores, cuando funciona en sistemas de ficheros insensibles a mayúsculas y minúsculas, permite a atacantes remotos evadir la lista negra de subidas y realizar ataques de subidas de ficheros no restringidos mediante la subida de un fichero con una extensión ejecutable que contiene letras mayúsculas, tal y como fue demostrado al utilizar un programa PHP."
    }
  ],
  "lastModified": "2026-06-17T00:11:20.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:x2engine:x2engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7092B138-754A-4597-827C-BBC355B4F4AE",
              "versionEndIncluding": "4.1.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}