#VU539 Arbitrary file uploads via BlogAPI in Drupal 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU539

#VU539 Arbitrary file uploads via BlogAPI in Drupal

Published: September 19, 2016 / Updated: February 17, 2017


Vulnerability identifier: #VU539
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Drupal
Software vendor:
Drupal

Description

The vulnerability allows a remote user to download harmful files to compromise the target system.
The weaness is caused by improper validation of uploaded files extension by BlogAPI module that allows attackers to insert certain files or data.
Successful exploitation of the vulnerability may result in malicious files uploading and vulnerable system compromising.

Remediation


External links