[VIM] CVE-2013-5576 == Joomla! media.php upload vulnerability? VU#639620

[Art Manion]

OSVDB associates CVE-2013-5576 with this Joomla! file upload vulnerability:

<http://developer.joomla.org/security/563-20130801-core-unauthorised-uploads.html>
(Thanks for the descriptive advisory.)

<http://osvdb.org/show/osvdb/95933>

<http://joomlacode.org/gf/project/joomla/tracker/?action=TrackerItemEdit&%20tracker_item_id=31626>

The CVE-2013-5576 description is still marked as RESERVED.

As Joomla! and other CMS are fairly popular targets, there is desire for 
an NVD (and CVE) entry.  Can anybody clarify?  The bug was that uploaded 
file names ending in '.' bypassed various checks for allowed 
extensions/types.  Upload and run arbitrary php.

More references:

<https://github.com/joomla/joomla-cms/commit/fa5645208eefd70f521cd2e4d53d5378622133d8>

<http://niiconsulting.com/checkmate/2013/08/critical-joomla-file-upload-vulnerability/>

<http://www.exploit-db.com/exploits/27610/>

<http://blog.sucuri.net/2013/08/joomla-media-manager-attacks-in-the-wild.html>

<http://www.cso.com.au/article/523528/joomla_patches_file_manager_vulnerability_responsible_hijacked_websites/>


  - Art