Lucene search

JpcertCVE-2010-3158

HistoryOct 19, 2010 - 8:00 p.m.

CVE-2010-3158

2010-10-1920:00:04

jpcert

web.nvd.nist.gov

cve-2010-3158

untrusted search path vulnerability

lhaplus

privilege escalation

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

Low

EPSS

Percentile

5.1%

JSON

Untrusted search path vulnerability in Lhaplus before 1.58 allows local users to gain privileges via a Trojan horse executable file in the current working directory.

Affected configurations

Nvd

Node

lhapluslhaplusRange≤1.57

lhapluslhaplusMatch1.52

lhapluslhaplusMatch1.53

lhapluslhaplusMatch1.55

lhapluslhaplusMatch1.56

VendorProductVersionCPE
lhapluslhaplus*cpe:2.3:a:lhaplus:lhaplus:*:*:*:*:*:*:*:*
lhapluslhaplus1.52cpe:2.3:a:lhaplus:lhaplus:1.52:*:*:*:*:*:*:*
lhapluslhaplus1.53cpe:2.3:a:lhaplus:lhaplus:1.53:*:*:*:*:*:*:*
lhapluslhaplus1.55cpe:2.3:a:lhaplus:lhaplus:1.55:*:*:*:*:*:*:*
lhapluslhaplus1.56cpe:2.3:a:lhaplus:lhaplus:1.56:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lhaplus	lhaplus	*	cpe:2.3:a:lhaplus:lhaplus::::::::
lhaplus	lhaplus	1.52	cpe:2.3:a:lhaplus:lhaplus:1.52:::::::*
lhaplus	lhaplus	1.53	cpe:2.3:a:lhaplus:lhaplus:1.53:::::::*
lhaplus	lhaplus	1.55	cpe:2.3:a:lhaplus:lhaplus:1.55:::::::*
lhaplus	lhaplus	1.56	cpe:2.3:a:lhaplus:lhaplus:1.56:::::::*

References

jvn.jp/jp/JVN18774708/index.html

jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000039.html

secunia.com/advisories/41742

www7a.biglobe.ne.jp/~schezo/dll_vul.html

exchange.xforce.ibmcloud.com/vulnerabilities/64436

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

AI Score

6.6

Confidence

Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2010-3158