FCKeditor.Java Connector Servlet 'CurrentFolder' Infinite Loop DoS

medium Nessus Plugin ID 39875

Language:

Synopsis

A web application running on the remote host has a denial of service vulnerability.

Description

The remote web server is hosting a web application that uses FCKeditor.Java, which is used to run FCKeditor in a Java environment.

Input to the 'CurrentFolder' parameter of the connector servlet is not sanitized properly. It is possible to create a specially crafted request that could put the web server into an infinite loop. A remote attacker could use this to create a denial of service.

Solution

Upgrade to FCKeditor.Java version 2.4.2 or later.

Plugin Details

Severity: Medium

ID: 39875

File Name: fckeditor_java_currentfolder_dos.nasl

Version: 1.18

Type: remote

Family: CGI abuses

Published: 7/20/2009

Updated: 4/11/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Ease: No known exploits are available

Patch Publication Date: 7/15/2009

Vulnerability Publication Date: 7/7/2009

Reference Information

CVE: CVE-2009-4875

BID: 35709

SECUNIA: 35870

Detections

Analytics