CVE-2006-0658: Medium severity FCKeditor FCKeditor vulnerability

Published Feb 13, 2006

Updated

Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.

Affected Software

2 affected components

FCKeditor FCKeditor=2.0

FCKeditor FCKeditor=2.2

Event History

Feb 13, 2006

CVE Published

11:06 AM

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0658?

CVE-2006-0658 is considered a high severity vulnerability due to its potential for remote code execution.

How do I fix CVE-2006-0658?

To fix CVE-2006-0658, ensure that the DeniedExtensions configuration in FCKeditor includes all potential script file extensions.

What versions of FCKeditor are affected by CVE-2006-0658?

FCKeditor versions 2.0 and 2.2 are affected by CVE-2006-0658.

What type of vulnerability is CVE-2006-0658?

CVE-2006-0658 represents an incomplete blacklist vulnerability allowing unauthorized file uploads.

Can CVE-2006-0658 lead to data breaches?

Yes, CVE-2006-0658 can lead to data breaches if attackers upload and execute malicious scripts.