CVE-2014-9261: Path Traversal
Published Mar 23, 2015
·Updated
The sanitize function in Codoforum 2.5.1 does not properly implement filtering for directory traversal sequences, which allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to index.php.
Affected Software
1 affected component
Codologic Codoforum=2.5.1
Event History
Mar 23, 2015
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9261?
CVE-2014-9261 is classified with a medium severity due to its potential to allow unauthorized file access.
2
How do I fix CVE-2014-9261?
To fix CVE-2014-9261, upgrade to a patched version of Codoforum that correctly sanitizes input paths.
3
What type of attacks can CVE-2014-9261 facilitate?
CVE-2014-9261 can facilitate directory traversal attacks, allowing attackers to read sensitive files on the server.
4
Which version of Codoforum is affected by CVE-2014-9261?
Codoforum version 2.5.1 is the affected version by CVE-2014-9261.
5
Is CVE-2014-9261 a known vulnerability?
Yes, CVE-2014-9261 is a publicly documented vulnerability that has been acknowledged in security circles.