Lucene search

[email protected]CVE-2006-6382

HistoryDec 07, 2006 - 9:28 p.m.

CVE-2006-6382

2006-12-0721:28:00

[email protected]

web.nvd.nist.gov

cve-2006-6382

information security

h-sphere

log file permissions

symlink attack

vulnerability

6.8 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user’s directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

Affected configurations

NVD

Node

positive_softwareh-sphereMatch2.4.3

CPENameOperatorVersion
positive_software:h-spherepositive software h-sphereeq2.4.3

CPE	Name	Operator	Version
positive_software:h-sphere	positive software h-sphere	eq	2.4.3

References

secunia.com/advisories/23199

www.securityfocus.com/bid/21436

exchange.xforce.ibmcloud.com/vulnerabilities/30753

6.8 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2006-6382

nvd1 cvelist1