VDB
CVE-2013-5576
CVE-2013-5576
PUBLISHED
CVSS 6.800000190734863 MEDIUM
administrator/components/com_media/helpers/media.php in the media manager in Joomla! 2.5.x before 2.5.14 and 3.x before 3.1.5 allows remote authenticated users or remote attackers to bypass intended access restrictions and upload files with dangerous extensions via a filename with a trailing . (dot), as exploited in the wild in August 2013.
EPSS 52.12% · 98.0th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
52.12%
98.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | *, * |
| joomla | joomla\! | 2.5.0, 2.5.2, 2.5.3 |
Timeline
- Aug 15, 2013 PoC Published
- Oct 9, 2013 CVE Published
- May 29, 2018 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 3, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Feb 8, 2023 EPSS Score
- Apr 2, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Sep 7, 2023 EPSS Score
References
- http://www.kb.cert.org/vuls/id/639620 advisory
- 27610 exploit
- http://developer.joomla.org/security/563-20130801-core-unauthorised-uploads.html url
- http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&tracker_item_id=31626 url
- [oss-security] 20130824 Re: CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 mailing-list
- https://github.com/joomla/joomla-cms/commit/1ed07e257a2c0794ba19e864f7c5101e7e8c41d2 url
- https://github.com/joomla/joomla-cms/commit/fa5645208eefd70f521cd2e4d53d5378622133d8 url
- [oss-security] 20130824 CVE request: Joomla unauthorised uploads before 2.5.14 / 3.1.5 mailing-list
- http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_websites/ url
- https://nvd.nist.gov/vuln/detail/CVE-2013-5576 advisory
- http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_websites url