CVE-2010-2797: Path Traversal

Q: What is the severity of CVE-2010-2797?

CVE-2010-2797 is considered a high severity vulnerability due to its potential to allow remote file inclusion and execution.

Q: How do I fix CVE-2010-2797?

To fix CVE-2010-2797, upgrade to CMS Made Simple version 1.8.1 or later.

Q: What software is affected by CVE-2010-2797?

CVE-2010-2797 affects multiple versions of CMS Made Simple including versions from 1.0 to 1.6.8.

Q: What is the exploit method of CVE-2010-2797?

CVE-2010-2797 can be exploited through a directory traversal attack that sends a crafted request to admin scripts.

Q: Is CVE-2010-2797 easily exploitable?

Yes, CVE-2010-2797 is easily exploitable by attackers who can manipulate input parameters to include arbitrary files.

Published Oct 8, 2010

Updated

Directory traversal vulnerability in lib/translation.functions.php in CMS Made Simple before 1.8.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the defaultcmslang parameter to an admin script, as demonstrated by admin/addbookmark.php, a different vulnerability than CVE-2008-5642.

Affected Software

57 affected components

CMSmadesimple CMS Made Simple=1.4.1

CMSmadesimple CMS Made Simple=1.5.3

CMSmadesimple CMS Made Simple=1.2.4

CMSmadesimple CMS Made Simple=1.0.7

CMSmadesimple CMS Made Simple=1.6.2

CMSmadesimple CMS Made Simple=1.0-beta5

CMSmadesimple CMS Made Simple=1.1.1

CMSmadesimple CMS Made Simple=1.1.3.1

CMSmadesimple CMS Made Simple=1.4-beta2

CMSmadesimple CMS Made Simple=1.6.5

CMSmadesimple CMS Made Simple=1.6.7

CMSmadesimple CMS Made Simple=1.0-beta6

CMSmadesimple CMS Made Simple=1.0.5

CMSmadesimple CMS Made Simple=1.6

CMSmadesimple CMS Made Simple=1.0.6

CMSmadesimple CMS Made Simple=1.3.1

CMSmadesimple CMS Made Simple=1.6.4

CMSmadesimple CMS Made Simple=1.1.4.1

CMSmadesimple CMS Made Simple=1.2

CMSmadesimple CMS Made Simple=1.2.1

CMSmadesimple CMS Made Simple=1.2-beta2

CMSmadesimple CMS Made Simple=1.7

CMSmadesimple CMS Made Simple=1.0.8

CMSmadesimple CMS Made Simple=1.4

CMSmadesimple CMS Made Simple=1.2.2

CMSmadesimple CMS Made Simple=1.5.2

CMSmadesimple CMS Made Simple=1.4-beta1

CMSmadesimple CMS Made Simple=1.0-beta1

CMSmadesimple CMS Made Simple=1.6.1

CMSmadesimple CMS Made Simple=1.0.4

CMSmadesimple CMS Made Simple=1.0.2

CMSmadesimple CMS Made Simple=1.2.3

CMSmadesimple CMS Made Simple=1.5-beta1

CMSmadesimple CMS Made Simple=1.1-rc1

CMSmadesimple CMS Made Simple=1.1

CMSmadesimple CMS Made Simple=1.0-beta2

CMSmadesimple CMS Made Simple=1.2-rc1

CMSmadesimple CMS Made Simple=1.0.1

CMSmadesimple CMS Made Simple=1.1.2

CMSmadesimple CMS Made Simple=1.3-beta1

CMSmadesimple CMS Made Simple=1.0-beta3

CMSmadesimple CMS Made Simple=1.1-rc2

CMSmadesimple CMS Made Simple=1.6.6

CMSmadesimple CMS Made Simple=1.3

CMSmadesimple CMS Made Simple=1.2-beta3

CMSmadesimple CMS Made Simple=1.2-beta1

CMSmadesimple CMS Made Simple=1.3-beta2

CMSmadesimple CMS Made Simple=1.5.1

CMSmadesimple CMS Made Simple=1.0-beta4

CMSmadesimple CMS Made Simple=1.0

CMSmadesimple CMS Made Simple=1.0.3

CMSmadesimple CMS Made Simple=1.5.4

CMSmadesimple CMS Made Simple<=1.6.8

CMSmadesimple CMS Made Simple=1.1-rc3

CMSmadesimple CMS Made Simple=1.2.5

CMSmadesimple CMS Made Simple=1.5

CMSmadesimple CMS Made Simple=1.6.3

Event History

Oct 8, 2010

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-2797?

CVE-2010-2797 is considered a high severity vulnerability due to its potential to allow remote file inclusion and execution.

How do I fix CVE-2010-2797?

To fix CVE-2010-2797, upgrade to CMS Made Simple version 1.8.1 or later.

What software is affected by CVE-2010-2797?