1. CVE-Search
  2. CVE-2006-2831
ID CVE-2006-2831
Summary Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
References
Vulnerable Configurations
  • cpe:2.3:a:drupal:drupal:4.6:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.0:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.6.7:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:drupal:drupal:4.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:drupal:drupal:4.7.1:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 18-10-2018 - 16:43)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 18245
bugtraq 20060602 [DRUPAL-SA-2006-007] Drupal 4.6.8 / 4.7.2 fixes arbitrary file execution issue
confirm
debian DSA-1125
secunia 21244
sreason 1042
Last major update 18-10-2018 - 16:43
Published 06-06-2006 - 00:02
Last modified 18-10-2018 - 16:43
Back to Top