The default configuration of Uber Uploader (UU) 5.3.6 and earlier does not block uploads of (1) .html, (2) .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via (a) uu_file_upload.php, related to uu_file_upload.js and (b) uber_uploader_file.php, related to uber_uploader_file.js, a different issue than CVE-2007-0123. NOTE: the vendor disputes the severity of the issue, noting that it is the administrator's responsibility to "add file extensions that you may or may not want uploaded."
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2008-01-08T19:00:00
Updated: 2018-10-15T20:57:01
Reserved: 2008-01-08T00:00:00
Link: CVE-2007-6676
JSON object: View
NVD Information
Status : Modified
Published: 2008-01-08T19:46:00.000
Modified: 2018-10-15T21:56:01.837
Link: CVE-2007-6676
JSON object: View
Redhat Information
No data.
CWE