CVE-2009-2166

2009-06-2220:30:00

CWE-22

mitre

web.nvd.nist.gov

cve-2009-2166

absolute path traversal

vulnerability

ocs inventory ng

unix

remote attackers

arbitrary files

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.016

Percentile

87.5%

JSON

Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.

Affected configurations

Nvd

Node

ocsinventory-ngocs_inventory_ngRange≤1.02

ocsinventory-ngocs_inventory_ngMatch1.0

ocsinventory-ngocs_inventory_ngMatch1.0beta

ocsinventory-ngocs_inventory_ngMatch1.0rc1

ocsinventory-ngocs_inventory_ngMatch1.0rc2

ocsinventory-ngocs_inventory_ngMatch1.0rc3

ocsinventory-ngocs_inventory_ngMatch1.0rc3-1

ocsinventory-ngocs_inventory_ngMatch1.01

ocsinventory-ngocs_inventory_ngMatch1.02rc1

ocsinventory-ngocs_inventory_ngMatch1.02rc2

ocsinventory-ngocs_inventory_ngMatch1.02rc3

AND

unixunix

VendorProductVersionCPE
ocsinventory-ngocs_inventory_ng*cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:*:*:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.0cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:*:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.0cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:beta:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.0cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc1:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.0cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc2:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.0cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc3:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.0cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc3-1:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.01cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.01:*:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.02cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.02:rc1:*:*:*:*:*:*
ocsinventory-ngocs_inventory_ng1.02cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.02:rc2:*:*:*:*:*:*

Vendor	Product	Version	CPE
ocsinventory-ng	ocs_inventory_ng	*	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng::::::::
ocsinventory-ng	ocs_inventory_ng	1.0	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:::::::*
ocsinventory-ng	ocs_inventory_ng	1.0	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:beta::::::
ocsinventory-ng	ocs_inventory_ng	1.0	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc1::::::
ocsinventory-ng	ocs_inventory_ng	1.0	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc2::::::
ocsinventory-ng	ocs_inventory_ng	1.0	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc3::::::
ocsinventory-ng	ocs_inventory_ng	1.0	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.0:rc3-1::::::
ocsinventory-ng	ocs_inventory_ng	1.01	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.01:::::::*
ocsinventory-ng	ocs_inventory_ng	1.02	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.02:rc1::::::
ocsinventory-ng	ocs_inventory_ng	1.02	cpe:2.3:a:ocsinventory-ng:ocs_inventory_ng:1.02:rc2::::::