CVE-2008-6171
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
87.1%
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for “IP-based virtual hosts,” allows remote attackers to include and execute arbitrary files via the HTTP Host header.
Affected configurations
References
drupal.org/files/sa-2008-067/SA-2008-067-5.11.patch
drupal.org/node/324824
secunia.com/advisories/32389
secunia.com/advisories/32441
www.securityfocus.com/bid/31900
www.vupen.com/english/advisories/2008/2913
exchange.xforce.ibmcloud.com/vulnerabilities/46049
www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html
www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
87.1%