Lucene search

[email protected]CVE-2008-0231

HistoryJan 11, 2008 - 12:46 a.m.

CVE-2008-0231

2008-01-1100:46:00

CWE-22

[email protected]

web.nvd.nist.gov

cve-2008-0231

directory traversal

index.php

tuned studios

subwoofer

freeze theme

orange cutout

lonely maple

endless

classic theme

music theme

remote file inclusion

php 5

security vulnerability

nvd

8.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.025 Low

EPSS

Percentile

90.2%

JSON

Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via “…” sequences in the page parameter. NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments.

CPENameOperatorVersion
tuned_studios:endlesstuned studios endlesseq*
tuned_studios:subwoofertuned studios subwoofereq*
tuned_studios:lonely_mapletuned studios lonely mapleeq*
tuned_studios:music_themetuned studios music themeeq*
tuned_studios:classic_themetuned studios classic themeeq*
tuned_studios:orange_cutouttuned studios orange cutouteq*
tuned_studios:freeze_themetuned studios freeze themeeq*

CPE	Name	Operator	Version
tuned_studios:endless	tuned studios endless	eq	*
tuned_studios:subwoofer	tuned studios subwoofer	eq	*
tuned_studios:lonely_maple	tuned studios lonely maple	eq	*
tuned_studios:music_theme	tuned studios music theme	eq	*
tuned_studios:classic_theme	tuned studios classic theme	eq	*
tuned_studios:orange_cutout	tuned studios orange cutout	eq	*
tuned_studios:freeze_theme	tuned studios freeze theme	eq	*

References

securityreason.com/securityalert/3532

www.securityfocus.com/archive/1/485991/100/0/threaded

www.securityfocus.com/bid/27196

exchange.xforce.ibmcloud.com/vulnerabilities/39555

www.exploit-db.com/exploits/4876

8.3 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.025 Low

EPSS

Percentile

90.2%

JSON

Related for CVE-2008-0231

cvelist1 prion1