CVEvulnerability

CVE-2012-1467

6.5 MEDIUM Published 2012-09-06 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-09-06
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-22

Description

Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php.

Affected configurations

• pkp open journal systems (<= 2.3.6)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References