The default configuration of Uber Uploader (UU) 5.3.6 and earlier...

5 CVSS

Vulnerability Description

The default configuration of Uber Uploader (UU) 5.3.6 and earlier does not block uploads of (1) .html, (2) .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via (a) uu_file_upload.php, related to uu_file_upload.js and (b) uber_uploader_file.php, related to uber_uploader_file.js, a different issue than CVE-2007-0123. NOTE: the vendor disputes the severity of the issue, noting that it is the administrator's responsibility to "add file extensions that you may or may not want uploaded."

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2007-6676

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from uber uploader

View All →

CVE-2007-0123

Unrestricted file upload vulnerability in Uber Uploader 4.2 allows remote...

Medium 6.8

Affected Vendor

uber uploader

View all reports →

Affected Software

uber uploader

Vulnerable Versions:

Timeline

Official Publish: January 8th, 2008

Last Modified: August 7th, 2024

Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.