CVE-2007-0147

Cuyahoga before 1.0.1 installs the FCKEditor component with an incorrect deny statement in a Web.config file, which allows remote attackers to upload files when these privileges were intended only for the Administrator and Editor roles.

🔗 References (10)

• cve@mitrehttp://cuyahoga.svn.sourceforge.net/viewvc/cuyahoga?view=rev&revision=551
• cve@mitrehttp://osvdb.org/32643
• cve@mitrehttp://secunia.com/advisories/23662
• cve@mitrehttp://www.cuyahoga-project.org/10/section.aspx/61
• cve@mitrehttp://www.securityfocus.com/bid/21927
• af854a3a-2127-422b-91ae-364da2661108http://cuyahoga.svn.sourceforge.net/viewvc/cuyahoga?view=rev&revision=551
• af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/32643
• af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/23662
• af854a3a-2127-422b-91ae-364da2661108http://www.cuyahoga-project.org/10/section.aspx/61
• af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/21927