CVE-2013-0136

Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.

CVSS v2.0

8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C

EPSS

40.34% chance of exploitation in the next 30 days, 99th percentile

Published

2013-06-01

Updated

2024-09-17

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/mutiny_frontend_uploa…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/25517

References

• CVE Record
• NVD entry

Related

• CVE-2013-0135
• CVE-2013-0140
• CVE-2013-0126
• CVE-2013-0141
• CVE-2013-0125
• CVE-2013-0143