Unscored severity · published Jul 5, 2009
CVE-2009-2265
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal…
–
CVSS
83.9%
EPSS
No
On KEV
Description
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.
Exploitation
Is it being used?
Exploit prediction (EPSS)83.9% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FC
Fckeditor · Fckeditor
through 2.6.4; 2.0; 2.0_fc; 2.0_rc2; 2.0rc2; 2.0rc3; +21 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2265
isc.sans.org
http://isc.sans.org/diary.html?storyid=6724
mail.zope.org
http://mail.zope.org/pipermail/zope-dev/2009-July/037195.html
packetstormsecurity.com
http://packetstormsecurity.com/files/163271/Adobe-ColdFusion-8-Remote-Command-Execution.html
secunia.com
http://secunia.com/advisories/35833
secunia.com
http://secunia.com/advisories/35909
sourceforge.net
http://sourceforge.net/project/shownotes.php?release_id=695430
More from Fckeditor
–
CVE-2009-2324
Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka…
–
CVE-2008-6178
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products,…
–
CVE-2006-6978
Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FCKEditor allows remote attackers to execute arbitrary JavaScript via the javascript: URI in the (1)…
–
CVE-2006-2529
editor/filemanager/upload/php/upload.php in FCKeditor before 2.3 Beta, when the upload feature is enabled, does not verify the Type parameter, which allows remote attackers to…
–
CVE-2006-0921
Multiple directory traversal vulnerabilities in connector.php in FCKeditor 2.0 FC, as used in products such as RunCMS, allow remote attackers to list and create arbitrary…