NVD Vulnerability Detail

CVE-2015-8832

Summary	Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a (1) .pht, (2) .phps, or (3) .phtml extension.
Publication Date	Feb. 10, 2017, 12:59 a.m.
Registration Date	Jan. 26, 2021, 2:59 p.m.
Last Update	Nov. 21, 2024, 11:39 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:dotclear:dotclear::::::::			2.8.1

Related information, measures and tools

No	URL	タグ
1	http://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2	Release Notes Vendor Advisory
2	http://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2	Release Notes Vendor Advisory
3	http://packetstormsecurity.com/files/134352/dotclear-2.8.1-Shell-Upload.html	Exploit Patch Third Party Advisory
4	http://packetstormsecurity.com/files/134352/dotclear-2.8.1-Shell-Upload.html	Exploit Patch Third Party Advisory
5	http://seclists.org/fulldisclosure/2015/Nov/58	Exploit Mailing List Patch Third Party Advisory
6	http://seclists.org/fulldisclosure/2015/Nov/58	Exploit Mailing List Patch Third Party Advisory
7	http://www.openwall.com/lists/oss-security/2016/03/05/4	Mailing List Patch Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2016/03/05/4	Mailing List Patch Third Party Advisory
9	http://www.openwall.com/lists/oss-security/2016/03/07/5	Mailing List Patch Third Party Advisory
10	http://www.openwall.com/lists/oss-security/2016/03/07/5	Mailing List Patch Third Party Advisory
11	http://www.securityfocus.com/bid/96379
12	http://www.securityfocus.com/bid/96379
13	https://blog.curesec.com/article/blog/dotclear-281-Code-Execution-93.html	Exploit Patch Third Party Advisory
14	https://blog.curesec.com/article/blog/dotclear-281-Code-Execution-93.html	Exploit Patch Third Party Advisory
15	https://hg.dotclear.org/dotclear/rev/198580bc3d80	Issue Tracking Patch Vendor Advisory
16	https://hg.dotclear.org/dotclear/rev/198580bc3d80	Issue Tracking Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-284	不適切なアクセス制御	https://cwe.mitre.org/data/definitions/284.html

JVN Vulnerability Information

Dotclear の inc/core/class.dc.core.php における任意の PHP コードを実行される脆弱性

Title	Dotclear の inc/core/class.dc.core.php における任意の PHP コードを実行される脆弱性
Summary	Dotclear の inc/core/class.dc.core.php には、不完全なブラックリストにより、任意の PHP コードを実行される脆弱性が存在します。
Possible impacts	"メディアアイテムの管理 (manage their own media items)" および "エントリおよびコメントの管理 (manage their own entries and comments)" パーミッションを持つリモート認証されたユーザにより、(1) .pht、(2) .phps、または (3) .phtml 拡張子を持つファイルをアップロードされることで、任意の PHP コードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 25, 2015, midnight
Registration Date	Feb. 27, 2017, 3:04 p.m.
Last Update	Feb. 27, 2017, 3:04 p.m.

Affected System

Dotclear

Dotclear 2.8.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-8832	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8832
National Vulnerability Database (NVD)
2	CVE-2015-8832	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8832

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-284	https://cwe.mitre.org/data/definitions/284.html

ベンダー情報

No	Name	URL
Dotclear
1	Enforce media exclusion extension control, thanks Tim Coen for report	https://hg.dotclear.org/dotclear/rev/198580bc3d80
Dotclear News
2	Dotclear 2.8.2	https://dotclear.org/blog/post/2015/10/25/Dotclear-2.8.2

Change Log

No	Changed Details	Date of change
0	[2017年02月27日] 掲載	Feb. 17, 2018, 10:37 a.m.