Lucene search

MitreCVE-2008-1409

HistoryMar 20, 2008 - 10:44 a.m.

CVE-2008-1409

2008-03-2010:44:00

CWE-22

mitre

web.nvd.nist.gov

exero cms

vulnerabilities

directory traversal

security

cve-2008-1409

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.019

Percentile

88.6%

JSON

Multiple directory traversal vulnerabilities in the Default theme in Exero CMS 1.0.1 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the theme parameter to (1) index.php, (2) editpassword.php, and (3) avatar.php in usercp/; (4) custompage.php; (5) errors/404.php; (6) memberslist.php and (7) profile.php in members/; (8) index.php and (9) fullview.php in news/; and (10) nopermission.php.

Affected configurations

Nvd

Node

exeroexero_cmsMatch1.0.1

VendorProductVersionCPE
exeroexero_cms1.0.1cpe:2.3:a:exero:exero_cms:1.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
exero	exero_cms	1.0.1	cpe:2.3:a:exero:exero_cms:1.0.1:::::::*

References

www.securityfocus.com/bid/28273

www.vupen.com/english/advisories/2008/0909/references

exchange.xforce.ibmcloud.com/vulnerabilities/41238

www.exploit-db.com/exploits/5265

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

AI Score

7.4

Confidence

Low

EPSS

0.019

Percentile

88.6%

JSON

Related for CVE-2008-1409