6.8

CVE-2011-4449

Exploit
actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typically absent from an Apache HTTP Server TypesConfig file, which makes it easier for remote attackers to execute arbitrary PHP code by placing this code in a file whose name has multiple extensions, as demonstrated by a (1) .mm or (2) .vpp file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wikkawiki ≫ Wikkawiki Version1.3.1
Wikkawiki ≫ Wikkawiki Version1.3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.14% 0.895
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://wush.net/trac/wikka/ticket/1097
Vendor Advisory
http://wush.net/trac/wikka/changeset/1822
Patch
Exploit