CVEvulnerability

CVE-2014-2042

7.5 HIGH Published 2014-04-28 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-04-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P

Description

Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/.

Affected configurations

• livetecs timeline (<= 6.2.8) • livetecs timeline 2.81 • livetecs timeline 2.91 • livetecs timeline 2.94 • livetecs timeline 3.0.1 • livetecs timeline 3.0.3 • livetecs timeline 3.0.5 • livetecs timeline 3.1.1 • livetecs timeline 3.2.1 • livetecs timeline 3.5.1 • livetecs timeline 3.6.1 • livetecs timeline 3.7.1 • livetecs timeline 3.8.1 • livetecs timeline 4.2.1 • livetecs timeline 4.3.1 • livetecs timeline 4.9.1 • livetecs timeline 5.2.1 • livetecs timeline 6.0.1 • livetecs timeline 6.2.1 • livetecs timeline 6.2.3 • livetecs timeline 6.2.4 • livetecs timeline 6.2.6 • livetecs timeline 6.2.7 • livetecs timeline 6.2.71

References