CVE-2011-0678

{"id": "CVE-2011-0678", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-01-28T21:00:30.420", "references": [{"url": "http://osvdb.org/70669", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/43031", "source": "cve@mitre.org"}, {"url": "http://www.exploitdevelopment.com/Vulnerabilities/2010-WEB-002.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/528212", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/45985", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2011/0217", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/65013", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted file upload vulnerability in the EasyEdit module in Lomtec ActiveWeb Professional 3.0 allows remote attackers to execute arbitrary code by uploading an executable file via the UploadDirectory and Accepted Extensions fields in the getImagefile component of EasyEdit.cfm."}, {"lang": "es", "value": "Vulnerabilidad de subida no restringida de ficheros en el m\u00f3dulo EasyEdit en Lomtec ActiveWeb Professional v3.0, permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n al subir un fichero con una extensi\u00f3n ejecutable a trav\u00e9s de campos UploadDirectory y Accepted Extensions en el componente Imagefile de EasyEdit.cfm."}], "lastModified": "2017-08-17T01:33:41.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lomtec:activeweb:3.0:*:professional:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11689837-E821-4D7C-98C4-1B3ADCC0DDCC"}], "operator": "OR"}]}], "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/434.html\r\n\r\n'CWE-434: Unrestricted Upload of File with Dangerous Type'", "sourceIdentifier": "cve@mitre.org"}