Vulnerability Description
administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended access restrictions and upload files with dangerous extensions via a filename with a trailing . (dot), as exploited in the wild in August 2013.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joomla | Joomla\! | 2.5.0 |
Related Weaknesses (CWE)
References
- http://developer.joomla.org/security/563-20130801-core-unauthorised-uploads.html
- http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_
- http://seclists.org/oss-sec/2013/q3/484
- http://seclists.org/oss-sec/2013/q3/486
- http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_r
- http://www.exploit-db.com/exploits/27610Exploit
- http://www.kb.cert.org/vuls/id/639620US Government Resource
- https://github.com/joomla/joomla-cms/commit/1ed07e257a2c0794ba19e864f7c5101e7e8c
- https://github.com/joomla/joomla-cms/commit/fa5645208eefd70f521cd2e4d53d53786221ExploitPatch
- http://developer.joomla.org/security/563-20130801-core-unauthorised-uploads.html
- http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_
- http://seclists.org/oss-sec/2013/q3/484
- http://seclists.org/oss-sec/2013/q3/486
- http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_r
- http://www.exploit-db.com/exploits/27610Exploit
FAQ
What is CVE-2013-5576?
CVE-2013-5576 is a vulnerability with a CVSS score of 6.8 (MEDIUM). administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended a...
How severe is CVE-2013-5576?
CVE-2013-5576 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-5576?
Check the references section above for vendor advisories and patch information. Affected products include: Joomla Joomla\!.