Lucene search

[email protected]CVE-2005-2955

HistorySep 16, 2005 - 10:03 p.m.

CVE-2005-2955

2005-09-1622:03:00

[email protected]

web.nvd.nist.gov

atutor

code execution

file upload

security vulnerability

cve-2005-2955

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

16.4%

JSON

config.inc.php in ATutor 1.5.1, and possibly earlier versions, uses an incomplete blacklist to check for dangerous file extensions, which allows authenticated administrators or educators to execute arbitrary code by uploading files with other executable extensions such as .inc, .php4, or others.

Affected configurations

NVD

Node

adaptive_technology_resource_centreatutorMatch1.5.1

CPENameOperatorVersion
adaptive_technology_resource_centre:atutoradaptive technology resource centre atutoreq1.5.1

CPE	Name	Operator	Version
adaptive_technology_resource_centre:atutor	adaptive technology resource centre atutor	eq	1.5.1

References

marc.info/?l=bugtraq&m=112671176100432&w=2

rgod.altervista.org/atutor151.html

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

7.9 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

16.4%

JSON

Related for CVE-2005-2955

cvelist1 nvd2 cve1