{
  "id": "CVE-2008-0569",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2008-02-05T02:00:00.000",
  "lastModified": "2024-11-21T00:42:24.470",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "El m\u00f3dulo Comment Upload 4.7.x antes de 4.7.x-0.1 y 5.x antes de 5.x-0.1 para Drupal no utiliza las funciones correctamente en el m\u00f3dulo upload (actualizar), que permite a atacantes remotos evitar la validaci\u00f3n del upload y actualizar archivos arbitrarios y posiblemente ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores sin especificar."
    }
  ],
  "metrics": {
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 4.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:drupal:comment_upload_module:4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "3AE90D55-2062-4D8B-841B-B57EABF24B79"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:drupal:comment_upload_module:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "857EE6FC-1DF2-4DC7-BF8D-EE81B08E3FA7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "http://drupal.org/node/216024",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216035",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216036",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/28729",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/27544",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0374/references",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/216024",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/216035",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/216036",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28729",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/27544",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0374/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}