CVE-2012-2670

manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a...

CVE-2012-2670

manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a...

CVE-2012-2670

CVE-2012-2670 affects Collabtive prior to 0.7.6. Affected component: manageuser.php/ avatar upload handling. Root cause: improper access controls allow remote authenticated users, and possibly unauthenticated attackers, to bypass restrictions and upload/execute arbitrary files by uploading an ava...