CVE-2010-4608

🗓️ 29 Dec 2010 19:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Habari 0.6.5 allows remote attackers to obtain sensitive information via a direct request to (1) header.php and (2) comments_items.php in system/admin/, which reveals the installation path in an error message

Reporter	Title	Published	Views	Family All 8
Cvelist	CVE-2010-4608	29 Dec 201019:00	–	cvelist
Exploit DB	Habari Blog - Multiple Vulnerabilities	21 Dec 201000:00	–	exploitdb
EUVD	EUVD-2010-4574	7 Oct 202500:30	–	euvd
htbridge	Multiple Vulnerabilities in Habari	2 Dec 201000:00	–	htbridge
NVD	CVE-2010-4608	29 Dec 201022:33	–	nvd
OpenVAS	Habari Multiple Vulnerabilities	31 Dec 201000:00	–	openvas
Prion	Information disclosure	29 Dec 201022:33	–	prion
RedhatCVE	CVE-2010-4608	22 May 202512:29	–	redhatcve

NVD

Node

habariproject habariMatch0.6.5

Source	Link
htbridge	www.htbridge.ch/advisory/path_disclosure_in_habari.html
wiki	www.wiki.habariproject.org/en/Release_0.6.6
exploit-db	www.exploit-db.com/exploits/15799

Parameter	Position	Path	Description	CWE
status_data	query param	system/admin/dash_status.php	XSS due to unsanitized status_data parameter when register_globals is on	CWE-200
additem_form	query param	system/admin/dash_additem.php	XSS due to unsanitized additem_form parameter when register_globals is on	CWE-200

16 Jun 2026 23:25Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25

EPSS0.02492

CWE-200