MLdonkey 2.9.7 - Arbitrary File Disclosure
| Reporter | Title | Published | Views | Family All 29 |
|---|---|---|---|---|
 | CVE-2009-0753 | 23 Feb 200900:00 | – | circl |
 | CVE-2009-0753 | 3 Mar 200916:00 | – | cve |
 | CVE-2009-0753 | 3 Mar 200916:00 | – | cvelist |
 | [SECURITY] [DSA 1739-1] New mldonkey packages fix information disclosure | 13 Mar 200920:58 | – | debian |
 | CVE-2009-0753 | 3 Mar 200916:00 | – | debiancve |
 | Debian DSA-1739-1 : mldonkey - path traversal | 24 Mar 200900:00 | – | nessus |
| Fedora 9 : mldonkey-3.0.0-1.fc9 (2009-2703) | 17 Mar 200900:00 | – | nessus |
| Fedora 10 : mldonkey-3.0.0-1.fc10 (2009-2758) | 23 Apr 200900:00 | – | nessus |
| GLSA-200903-36 : MLDonkey: Information disclosure | 24 Mar 200900:00 | – | nessus |
 | EUVD-2009-0753 | 7 Oct 202500:30 | – | euvd |
10
MLdonkey (up to 2.9.7) has a vulnerability that allows remote user to access any
file with rights of running Mldonkey daemon by supplying a
special-crafted request (ok, there's not much special about double
slash) to an Mldonkey http GUI (tcp/4080 usually).
Reference:
https://savannah.nongnu.org/bugs/?25667
Thus, the exploit would be as simple as accessing any file on a remote
host with your browser and double slash:
http://mlhost:4080//etc/passwd
# milw0rm.com [2009-02-23]Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Feb 2017 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 25
EPSS0.05803