CVE-2012-2670

Severity CVSS v4.0:

Pending analysis

Type:

CWE-20 Input Validation

Publication date:

17/06/2012

Last modified:

11/04/2025

Description

manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a direct request to the file in files/standard/avatar.

Impact

Vector 2.0

AV:N/AC:L/Au:S/C:P/I:P/A:P CVSS v2.0 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Attack Vector (AV): Network
Attack Complexity (AC): Low
Authentication (Au): Single
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): Physical

Base Score 2.0

6.50

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:o-dyn:collabtive::::::::		0.7.5 (including)
cpe:2.3:a:o-dyn:collabtive:0.6.4:::::::*
cpe:2.3:a:o-dyn:collabtive:0.6.5:::::::*
cpe:2.3:a:o-dyn:collabtive:0.7:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2012-2670

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools