Unscored severity · published Jun 17, 2012
CVE-2012-2670
manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute…
–
CVSS
1.5%
EPSS
No
On KEV
Description
manageuser.php in Collabtive before 0.7.6 allows remote authenticated users, and possibly unauthenticated attackers, to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg, then accessing it via a direct request to the file in files/standard/avatar.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Collabtive · O-dyn
through 0.7.5; 0.6.4; 0.6.5; 0.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2670
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2670
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-06/0007.html
www.collabtive.o-dyn.de
http://www.collabtive.o-dyn.de/blog/?p=426
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/06/06/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2012/06/06/9
www.securityfocus.com
http://www.securityfocus.com/archive/1/522973/30/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/53813
More from Collabtive
9.8
CVE-2013-5027
Collabtive 1.0 has incorrect access control
8.8
CVE-2015-0258
Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary…
6.1
CVE-2020-13655
An issue was discovered in Collabtive 3.0 and later
5.4
CVE-2024-48708
Collabtive 3.1 is vulnerable to Cross-Site Scripting (XSS) via the name parameter in (a) file tasklist.php under action = add/edit and in (b) file admin.php under action =…
5.4
CVE-2024-48707
Collabtive 3.1 is vulnerable to Cross-site scripting (XSS) via the name parameter under (a) action=add or action=edit within managemilestone.php file and (b) action=addpro within…