Description

The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.

Remediation

References

CVE-2012-5653

Related Vulnerabilities

Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3723)

Oracle JRE CVE-2013-2473 Vulnerability (CVE-2013-2473)

ownCloud Other Vulnerability (CVE-2015-5954)

Internet Information Services Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-1999-0349)

OpenSSL Resource Management Errors Vulnerability (CVE-2006-2937)

Severity

Medium

Classification

CVE-2012-5653 CWE-20

Tags

Missing Update Known Vulnerabilities