« Back to list

CVE-2008-0569

Status: ModifiedMedium (6.4)—

The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Drupal — Comment Upload Module

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2008-0569",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-02-05T02:00:00.000",
  "references": [
    {
      "url": "http://drupal.org/node/216024",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216035",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216036",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28729",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/27544",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0374/references",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216024",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/216035",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/216036",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28729",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27544",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0374/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El módulo Comment Upload 4.7.x antes de 4.7.x-0.1 y 5.x antes de 5.x-0.1 para Drupal no utiliza las funciones correctamente en el módulo upload (actualizar), que permite a atacantes remotos evitar la validación del upload y actualizar archivos arbitrarios y posiblemente ejecutar código arbitrario a través de vectores sin especificar."
    }
  ],
  "lastModified": "2026-06-16T22:49:53.730",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:comment_upload_module:4.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3AE90D55-2062-4D8B-841B-B57EABF24B79"
            },
            {
              "criteria": "cpe:2.3:a:drupal:comment_upload_module:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "857EE6FC-1DF2-4DC7-BF8D-EE81B08E3FA7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}