Lucene search

MitreCVE-2008-7016

HistoryAug 21, 2009 - 2:30 p.m.

CVE-2008-7016

2009-08-2114:30:00

CWE-352

mitre

web.nvd.nist.gov

cve-2008-7016

tnftpd

csrf

security vulnerability

remote attack

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.1

Confidence

Low

EPSS

0.002

Percentile

52.7%

JSON

tnftpd before 20080929 splits large command strings into multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unknown vectors, probably involving a crafted ftp:// link to a tnftpd server.

Affected configurations

Nvd

Node

luke_mewburntnftpdMatch20040810

luke_mewburntnftpdMatch20061217

luke_mewburntnftpdMatch20080609

VendorProductVersionCPE
luke_mewburntnftpd20040810cpe:2.3:a:luke_mewburn:tnftpd:20040810:*:*:*:*:*:*:*
luke_mewburntnftpd20061217cpe:2.3:a:luke_mewburn:tnftpd:20061217:*:*:*:*:*:*:*
luke_mewburntnftpd20080609cpe:2.3:a:luke_mewburn:tnftpd:20080609:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
luke_mewburn	tnftpd	20040810	cpe:2.3:a:luke_mewburn:tnftpd:20040810:::::::*
luke_mewburn	tnftpd	20061217	cpe:2.3:a:luke_mewburn:tnftpd:20061217:::::::*
luke_mewburn	tnftpd	20080609	cpe:2.3:a:luke_mewburn:tnftpd:20080609:::::::*

References

freshmeat.net/projects/tnftpd/?branch_id=14355&release_id=285654#

osvdb.org/48637

secunia.com/advisories/31958

exchange.xforce.ibmcloud.com/vulnerabilities/45534

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

7.1

Confidence

Low

EPSS

0.002

Percentile

52.7%

JSON

Related for CVE-2008-7016