CVE-2013-6234

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload."

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/125497Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/32040Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91504Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/125497Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/32040Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/91504Third Party Advisory, VDB Entry

Timeline

Published: Nov 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-62354.3Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arb CVE-2013-62369.8IZON IP 2.0.2: hard-coded password vulnerability CVE-2013-62373.5The ISL Desktop plugin for Windows before 1.4.7 for ISL Light 3.5.4 and earlier allows remote authenticated users to obtain sensitive inform CVE-2013-62396.1Cross-site scripting (XSS) vulnerability in the photo gallery model in Exis Contexis before 2.0 allows remote attackers to inject arbitrary CVE-2013-62414.0The Birthday widget in the backend in Open-Xchange (OX) AppSuite 7.2.x before 7.2.2-rev25 and 7.4.x before 7.4.0-rev14, in certain user-id s CVE-2013-62426.1Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite 6.22.3 before 6.22.3-rev5 and 6.22.4 before 6.22.4-re CVE-2013-62437.5SQL injection vulnerability in the Landing Pages plugin 1.2.3, before 20131009, and earlier for WordPress allows remote attackers to execute CVE-2013-62445.0The Live Update webdynpro application (webdynpro/dispatcher/sap.com/tc~slm~ui_lup/LUP) in SAP NetWeaver 7.31 and earlier allows remote attac CVE-2013-624510.0Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3, and 15.7 before 15 CVE-2013-62465.0The Dell Quest One Password Manager, possibly 5.0, allows remote attackers to bypass CAPTCHA protections and obtain sensitive information (u CVE-2013-62674.3Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML CVE-2013-62718.8Android 4.0 through 4.3 allows attackers to bypass intended access restrictions and remove device locks via a crafted application that invok