CVE-2010-1217: Path Traversal
Directory traversal vulnerability in the JE Form Creator (comjeformcr) component for Joomla!, when magicquotesgpc is disabled, allows remote attackers to read arbitrary files via directory traversal sequences in the view parameter to index.php. NOTE: the original researcher states that the affected product is JE Tooltip, not Form Creator; however, the exploit URL suggests that Form Creator is affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1217?
CVE-2010-1217 is considered a medium severity vulnerability due to its potential for unauthorized access to sensitive files.
How do I fix CVE-2010-1217?
To fix CVE-2010-1217, ensure that magic_quotes_gpc is enabled and update the JE Form Creator component to the latest version.
What software is affected by CVE-2010-1217?
CVE-2010-1217 affects the JE Form Creator component for Joomla! when magic_quotes_gpc is disabled.
Can CVE-2010-1217 lead to remote code execution?
CVE-2010-1217 does not directly lead to remote code execution, but it allows attackers to read arbitrary files, potentially leading to further exploits.
What are the indicators of exploitation for CVE-2010-1217?
Indicators of exploitation for CVE-2010-1217 may include unusual access logs showing file reads that include directory traversal sequences.