CVE-2011-4106

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute…

published October 26, 2013

CVSS
—
EPSS
23%
Percentile
97.8
In the wild
Unconfirmed
What it is

TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.23342 · 97.8th percentile
Published
2013-10-26T16:00Z
EPSS history
Timeline
  • 24 AUG 22:35Z
    EPSS moved 12% → 23%
    epss
  • 26 OCT 16:00Z
    TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute…
    cvelistv5