CVE-2009-3890

{"id": "CVE-2009-3890", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-11-17T18:30:00.313", "references": [{"url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "http://core.trac.wordpress.org/ticket/11122", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://secunia.com/advisories/37332", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/", "tags": ["Patch", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/15/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/15/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/16/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.osvdb.org/59958", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0142.html", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0149.html", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://archives.neohapsis.com/archives/fulldisclosure/2009-11/0153.html", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://core.trac.wordpress.org/ticket/11122", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/37332", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://wordpress.org/development/2009/11/wordpress-2-8-6-security-release/", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/15/2", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/15/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2009/11/16/1", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/59958", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a certain configuration of the mod_mime module in the Apache HTTP Server is enabled, allows remote authenticated users to execute arbitrary code by posting an attachment with a multiple-extension filename, and then accessing this attachment via a direct request to a wp-content/uploads/ pathname, as demonstrated by a .php.jpg filename."}, {"lang": "es", "value": "Vulnerabilidad de subida de archivos sin restricci\u00f3n en la funci\u00f3n wp_check_filetype en wp-includes/functions.php en WordPress anteriores a v2.8.6, cuando cierta configuraci\u00f3n del modulo mod_mime en el servidor HTTP Apache esta activado, permite a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario posteando un adjunto con un nombre de fichero con m\u00faltiples extensiones y luego accediendo a el a trav\u00e9s de una petici\u00f3n directa al nombre de ruta wp-content/uploads/, como se demuestra con el nombre de fichero .php.jpg."}], "lastModified": "2025-04-09T00:30:58.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E33698FD-9A82-413F-BADD-8E0719BB70A9", "versionEndIncluding": "2.8.5"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}