CVE-2009-0674
6 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
6.7 Medium
AI Score
Confidence
Low
0.01 Low
EPSS
Percentile
83.4%
images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to determine the existence of local files by sending requests with full pathnames in the aFonts array parameter, and then observing the error messages, which differ between existing and nonexistent pathnames.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ravenphpscripts:ravennuke | ravenphpscripts ravennuke | eq | 2.30 |
Related
6 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:S/C:P/I:P/A:P
6.7 Medium
AI Score
Confidence
Low
0.01 Low
EPSS
Percentile
83.4%