CVE-2006-0658

2006-02-1311:06:00

mitre

web.nvd.nist.gov

cve-2006-0658

vulnerability

fckeditor

connector.php

runcms

remote attackers

arbitrary script

file upload

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

Confidence

Low

EPSS

0.031

Percentile

91.1%

JSON

Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.

Affected configurations

Nvd

Node

fckeditorfckeditorMatch2.0

fckeditorfckeditorMatch2.2

VendorProductVersionCPE
fckeditorfckeditor2.0cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*
fckeditorfckeditor2.2cpe:2.3:a:fckeditor:fckeditor:2.2:*:*:*:*:*:*:*