CVE-2006-5031

描述

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.

如何修補 CVE-2006-5031

要修補 CVE-2006-5031,請將受影響套件升級到下列已修補版本。

• Debian/cakephp—升級至 1.1.13.4450-1 或更新版本
• Packagist/cakephp/cakephp—升級至 1.1.8.3544 或更新版本

CVE-2006-5031 正在被利用嗎?

中等 — EPSS 為 7.3%,可持續追蹤但非最高優先。

受影響套件(2)

• from 0, < 1.1.13.4450-1
• >= 1.0.1.2708, < 1.1.8.3544

參考連結(8)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2006-5031
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2006-5031
• PATCHgithub.com/cakephp/cakephp
• WEBcakeforge.org/frs/shownotes.php?release_id=134
• WEBsecunia.com