CVE-2014-2042

High

Published: 28/04/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

Livetecs Timelive before version 6.5.1 has an unrestricted file upload vulnerability in the Manage Project functionality. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and accessing it via a direct request.

Risk Assessment

This vulnerability poses a serious risk to organizations as it allows remote code execution, potentially leading to system compromise. It may result in data loss, privacy breaches, and damage to the company's reputation.

Recommendation

It is recommended to upgrade Livetecs Timelive to version 6.5.1 or later to mitigate this vulnerability. Additionally, implementing mechanisms to restrict file uploads to allowed types is advisable.

Other vulnerabilities in Livetecs Timelive

CVE-2014-1217High
Livetecs Timelive before 6.2.8 does not properly restrict access to systemsetting.aspx, allowing remote attackers to change configurations and obtain the database connection string and credentials.

Original NVD description (English source)

Unrestricted file upload vulnerability in the Manage Project functionality in Livetecs Timelive before 6.5.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in a predictable directory in Uploads/.