Vulnerability Details CVE-2008-3592
Unrestricted file upload vulnerability in the File Manager in the admin panel in Twentyone Degrees Symphony 1.7.01 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to a directory specified in the destination parameter, then accessing the uploaded file via a direct request, as demonstrated using workspace/masters/.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.048
EPSS Ranking 88.9%
CVSS Severity
CVSS v2 Score 8.5
References
- http://overture21.com/forum/comments.php?DiscussionID=1823
- http://secunia.com/advisories/31293
- http://securityreason.com/securityalert/4137
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44432
- https://www.exploit-db.com/exploits/6177
- http://overture21.com/forum/comments.php?DiscussionID=1823
- http://secunia.com/advisories/31293
- http://securityreason.com/securityalert/4137
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44432
- https://www.exploit-db.com/exploits/6177
Products affected by CVE-2008-3592
-
cpe:2.3:a:21degrees:symphony:*
-
cpe:2.3:a:21degrees:symphony:1.1
-
cpe:2.3:a:21degrees:symphony:1.5
-
cpe:2.3:a:21degrees:symphony:1.5.05
-
cpe:2.3:a:21degrees:symphony:1.5.06
-
cpe:2.3:a:21degrees:symphony:1.6.02
-
cpe:2.3:a:21degrees:symphony:1.7