CVE-2011-4106
Last modified
CVE-2011-4106 is a vulnerability of currently unknown severity. TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.. EPSS estimates a 23.16% chance of exploitation in the next 30 days.
Description
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Binarymoon | Timthumb | <= 1.99 |
References
- http://code.google.com/p/timthumb/issues/detail?id=212Exploit, Patch
- http://code.google.com/p/timthumb/issues/detail?id=212Exploit, Patch
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-4106?
How severe is CVE-2011-4106?
How do I fix CVE-2011-4106?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2011
- CVE-2011-4100The csnStreamDissector function in epan/dissectors/packet-cs…
- CVE-2011-4101The dissect_infiniband_common function in epan/dissectors/pa…
- CVE-2011-4102Heap-based buffer overflow in the erf_read_header function i…
- CVE-2011-4103emitters.py in Django Piston before 0.2.3 and 0.2.x before 0…
- CVE-2011-4104The from_yaml method in serializers.py in Django Tastypie be…
- CVE-2011-4105LightDM before 1.0.6 allows local users to change ownership …
- CVE-2011-4107The simplexml_load_string function in the XML import plug-in…6.5
- CVE-2011-4108The DTLS implementation in OpenSSL before 0.9.8s and 1.x bef…
- CVE-2011-4109Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, wh…
- CVE-2011-4110The user_update function in security/keys/user_defined.c in …
- CVE-2011-4111Buffer overflow in the ccid_card_vscard_handle_message funct…
- CVE-2011-4112The net subsystem in the Linux kernel before 3.1 does not pr…5.5
Are you affected by CVE-2011-4106?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST