Description

Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.

Remediation

References

CVE-2006-2831

Related Vulnerabilities

WordPress Plugin Floating Tweets Multiple Vulnerabilities (1.0.1)

Drupal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-10910)

WordPress Plugin Frontend File Manager Arbitrary File Upload (3.3)

WordPress Plugin Prevent files/folders access Cross-Site Request Forgery (1.1.1)

MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-2335)

Severity

High

Classification

CVE-2006-2831

Tags

Missing Update Known Vulnerabilities