CVE-2006-0660
7.5 High
AI Score
Confidence
Low
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.021 Low
EPSS
Percentile
89.0%
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via “…” or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.
| CPE | Name | Operator | Version |
|---|---|---|---|
| farsinews:farsinews | farsinews | eq | 2.1 |
| farsinews:farsinews | farsinews | eq | 2.5 |
| farsinews:farsinews | farsinews | eq | 2.1_beta2 |
References
forum.farsinewsteam.com/index.php?showtopic=71
forum.farsinewsteam.com/index.php?showtopic=76
secunia.com/advisories/18768
www.hamid.ir/security/farsinews2-5.txt
www.osvdb.org/23020
www.osvdb.org/23021
www.osvdb.org/23022
www.securityfocus.com/archive/1/424720/100/0/threaded
www.securityfocus.com/bid/16580
www.vupen.com/english/advisories/2006/0506
exchange.xforce.ibmcloud.com/vulnerabilities/24598
exchange.xforce.ibmcloud.com/vulnerabilities/24602
7.5 High
AI Score
Confidence
Low
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:P/A:N
0.021 Low
EPSS
Percentile
89.0%