The loadModule function in lib/WebGUI/Asset.pm in WebGUI before 7.5.30 (stable) allows remote attackers to execute arbitrary code by uploading a Perl module and accessing it via a crafted URL.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 00:52
Type | Values Removed | Values Added |
---|---|---|
References | () http://secunia.com/advisories/32438 - Vendor Advisory | |
References | () http://www.securityfocus.com/bid/31947 - Patch | |
References | () http://www.vupen.com/english/advisories/2008/2944 - | |
References | () http://www.webgui.org/bugs/tracker/8980 - | |
References | () http://www.webgui.org/getwebgui/advisories/webgui-7.5.30-stable-released - | |
References | () http://www.webgui.org/uploads/70/o2/70o29CTLCGWjntJrLYdmJA/asset-security-7.4.diff - | |
References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/46137 - |
Information
Published : 2008-10-30 20:56
Updated : 2024-11-21 00:52
NVD link : CVE-2008-4798
Mitre link : CVE-2008-4798
CVE.ORG link : CVE-2008-4798
JSON object : View
Products Affected
webgui
- webgui
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')