CVE-2012-1467: Path Traversal
Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tinymce/plugins/ibrowser/scripts/rfiles.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1467?
CVE-2012-1467 is classified as a high severity vulnerability due to its potential to allow remote authenticated users to manipulate files.
How do I fix CVE-2012-1467?
To fix CVE-2012-1467, upgrade Open Journal Systems to version 2.3.7 or later, where the vulnerability has been patched.
What types of attacks can CVE-2012-1467 facilitate?
CVE-2012-1467 can facilitate attacks that allow authenticated users to delete or rename arbitrary files on the server.
Who is affected by CVE-2012-1467?
CVE-2012-1467 affects users of Open Journal Systems versions prior to 2.3.7.
What component does CVE-2012-1467 affect in Open Journal Systems?
CVE-2012-1467 affects the iBrowser plugin library used within Open Journal Systems.