medium6.0
CVE-2012-5653
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrar…
Impact
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Drupal | Drupal | Versions 7.0, 7.1, 7.2, 7.3, 7.4, 7.5 |
| Debian | Debian Linux | Versions 6.0, 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://drupal.org/SA-CORE-2012-004
- http://drupalcode.org/project/drupal.git/commitdiff/b47f95d
- http://drupalcode.org/project/drupal.git/commitdiff/da8023a
- http://osvdb.org/88529
- http://www.debian.org/security/2013/dsa-2776
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
- http://www.openwall.com/lists/oss-security/2012/12/20/1
- http://www.securityfocus.com/bid/56993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80795
- http://drupal.org/SA-CORE-2012-004
- http://drupalcode.org/project/drupal.git/commitdiff/b47f95d
- http://drupalcode.org/project/drupal.git/commitdiff/da8023a
- http://osvdb.org/88529
- http://www.debian.org/security/2013/dsa-2776
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:074
- http://www.openwall.com/lists/oss-security/2012/12/20/1
- http://www.securityfocus.com/bid/56993
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80795