Lucene search

[email protected]CVE-2009-2546

HistoryJul 20, 2009 - 8:00 p.m.

CVE-2009-2546

2009-07-2020:00:11

CWE-22

[email protected]

web.nvd.nist.gov

cve

2009

2546

directory traversal

vulnerability

advanced electron forum

aef

remote attackers

arbitrary files

avatar

error message

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.4%

JSON

Directory traversal vulnerability in Advanced Electron Forum (AEF) 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Affected configurations

NVD

Node

anelectronadvanced_electron_forumMatch1.0.1

anelectronadvanced_electron_forumMatch1.0.2

anelectronadvanced_electron_forumMatch1.0.3

anelectronadvanced_electron_forumMatch1.0.4

anelectronadvanced_electron_forumMatch1.0.5

anelectronadvanced_electron_forumMatch1.0.6

anelectronadvanced_electron_forumMatch1.0.7

anelectronadvanced_electron_forumMatch1.0.8

CPENameOperatorVersion
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.1
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.2
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.3
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.4
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.5
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.6
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.7
anelectron:advanced_electron_forumanelectron advanced electron forumeq1.0.8

CPE	Name	Operator	Version
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.1
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.2
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.3
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.4
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.5
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.6
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.7
anelectron:advanced_electron_forum	anelectron advanced electron forum	eq	1.0.8

References

osvdb.org/55926

secunia.com/advisories/35646

exchange.xforce.ibmcloud.com/vulnerabilities/51776

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.7 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.4%

JSON

Related for CVE-2009-2546

cvelist1 prion1 nvd1