Lucene search

[email protected]CVE-2008-6960

HistoryAug 12, 2009 - 10:30 a.m.

CVE-2008-6960

2009-08-1210:30:00

CWE-264

[email protected]

web.nvd.nist.gov

x10media

mp3

search engine

script

remote file read

security vulnerability

7.5 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.048 Low

EPSS

Percentile

92.6%

JSON

download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 through 1.6 allows remote attackers to read arbitrary files via an encoded url parameter, as demonstrated by obtaining database credentials from includes/constants.php.

CPENameOperatorVersion
x10media:x10_automatic_mp3_scriptx10media x10 automatic mp3 scripteq1.5.5
x10media:x10_automatic_mp3_scriptx10media x10 automatic mp3 scripteq1.6

CPE	Name	Operator	Version
x10media:x10_automatic_mp3_script	x10media x10 automatic mp3 script	eq	1.5.5
x10media:x10_automatic_mp3_script	x10media x10 automatic mp3 script	eq	1.6

References

osvdb.org/49797

secunia.com/advisories/32537

www.securityfocus.com/bid/32227

www.vupen.com/english/advisories/2008/3062

exchange.xforce.ibmcloud.com/vulnerabilities/46489

www.exploit-db.com/exploits/7074

7.5 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.048 Low

EPSS

Percentile

92.6%

JSON

Related for CVE-2008-6960

prion1