CVE-2013-4898

Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in public/temporary/timeline/.

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

3.16% chance of exploitation in the next 30 days, 87th percentile

Published

2014-01-29

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/27272/

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27272

References

• CVE Record
• NVD entry

Related

• CVE-2013-4891
• CVE-2013-4900
• CVE-2013-4890
• CVE-2013-4945
• CVE-2013-4889
• CVE-2013-4946