Lucene search

[email protected]CVE-2005-3738

HistoryNov 22, 2005 - 11:03 a.m.

CVE-2005-3738

2005-11-2211:03:00

[email protected]

web.nvd.nist.gov

mambo

site server

security

vulnerability

remote attack

6.8 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.02 Low

EPSS

Percentile

88.8%

JSON

globals.php in Mambo Site Server 4.0.14 and earlier, when register_globals is disabled, allows remote attackers to overwrite variables in the GLOBALS array and conduct various attacks, as demonstrated using the mosConfig_absolute_path parameter to content.html.php for remote PHP file inclusion.

Affected configurations

NVD

Node

mambomambo_site_serverMatch4.0

mambomambo_site_serverMatch4.0.10

mambomambo_site_serverMatch4.0.11

mambomambo_site_serverMatch4.0.12

mambomambo_site_serverMatch4.0.12_beta

mambomambo_site_serverMatch4.0.12_beta_2

mambomambo_site_serverMatch4.0.12_rc1

mambomambo_site_serverMatch4.0.12_rc2

mambomambo_site_serverMatch4.0.12_rc3

mambomambo_site_serverMatch4.0.14

CPENameOperatorVersion
mambo:mambo_site_servermambo mambo site servereq4.0
mambo:mambo_site_servermambo mambo site servereq4.0.10
mambo:mambo_site_servermambo mambo site servereq4.0.11
mambo:mambo_site_servermambo mambo site servereq4.0.12
mambo:mambo_site_servermambo mambo site servereq4.0.12_beta
mambo:mambo_site_servermambo mambo site servereq4.0.12_beta_2
mambo:mambo_site_servermambo mambo site servereq4.0.12_rc1
mambo:mambo_site_servermambo mambo site servereq4.0.12_rc2
mambo:mambo_site_servermambo mambo site servereq4.0.12_rc3
mambo:mambo_site_servermambo mambo site servereq4.0.14

CPE	Name	Operator	Version
mambo:mambo_site_server	mambo mambo site server	eq	4.0
mambo:mambo_site_server	mambo mambo site server	eq	4.0.10
mambo:mambo_site_server	mambo mambo site server	eq	4.0.11
mambo:mambo_site_server	mambo mambo site server	eq	4.0.12
mambo:mambo_site_server	mambo mambo site server	eq	4.0.12_beta
mambo:mambo_site_server	mambo mambo site server	eq	4.0.12_beta_2
mambo:mambo_site_server	mambo mambo site server	eq	4.0.12_rc1
mambo:mambo_site_server	mambo mambo site server	eq	4.0.12_rc2
mambo:mambo_site_server	mambo mambo site server	eq	4.0.12_rc3
mambo:mambo_site_server	mambo mambo site server	eq	4.0.14

References

archives.neohapsis.com/archives/fulldisclosure/2005-11/0520.html

forum.mamboserver.com/showthread.php?t=66154

secunia.com/advisories/17622

securitytracker.com/id?1015258

www.securityfocus.com/archive/1/417215

www.securityfocus.com/archive/1/426942/100/0/threaded

www.securityfocus.com/archive/1/427196/100/0/threaded

www.securityfocus.com/bid/15461

www.vupen.com/english/advisories/2005/2473

6.8 Medium

AI Score

Confidence

Low

2.6 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

0.02 Low

EPSS

Percentile

88.8%

JSON

Related for CVE-2005-3738

cvelist1 openvas2 nessus1 nvd1