« Volver al listado

CVE-2015-4606

Estado: ModificadaAlta (7.5)—

Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

JOB Fair Project — JOB Fair

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-4606",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-06-16T16:59:05.643",
  "references": [
    {
      "url": "http://typo3.org/extensions/repository/view/jobfair",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-013/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/75238",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://typo3.org/extensions/repository/view/jobfair",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2015-013/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/75238",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de subida de ficheros sin restricciones en la extensión Job Fair (jobfair) anterior a 1.0.1 para TYPO3, cuando utiliza Apache con mod_mime, permite a atacantes remotos ejecutar código arbitrario mediante la subida de un fichero con una extensión ejecutable y posteriormente accediendo a ello a través de una solicitud directa al fichero en la carpeta de la subida de extensiones."
    }
  ],
  "lastModified": "2026-06-17T00:27:35.527",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:job_fair_project:job_fair:*:*:*:*:*:typo3:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DEEE6DF6-B34E-4F6B-967C-B2745F53A9EE",
              "versionEndIncluding": "1.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/434.html\">CWE-434: Unrestricted Upload of File with Dangerous Type</a>",
  "sourceIdentifier": "cve@mitre.org"
}