Lucene search

[email protected]CVE-2006-5733

HistoryNov 06, 2006 - 6:07 p.m.

CVE-2006-5733

2006-11-0618:07:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2006-5733

vulnerability

postnuke

directory traversal

remote attackers

arbitrary execution

pnsvlang

security

7.9 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.033 Low

EPSS

Percentile

91.4%

JSON

Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a … (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.

CPENameOperatorVersion
postnuke_software_foundation:postnukepostnuke software foundation postnukeeq0.762
postnuke_software_foundation:postnukepostnuke software foundation postnukele0.763

CPE	Name	Operator	Version
postnuke_software_foundation:postnuke	postnuke software foundation postnuke	eq	0.762
postnuke_software_foundation:postnuke	postnuke software foundation postnuke	le	0.763

References

community.postnuke.com/Article2787.htm

secunia.com/advisories/22983

www.securityfocus.com/bid/20897

www.securityfocus.com/bid/21218

exchange.xforce.ibmcloud.com/vulnerabilities/29992

www.exploit-db.com/exploits/2707

7.9 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.033 Low

EPSS

Percentile

91.4%

JSON

Related for CVE-2006-5733

cvelist1