CVE-2005-4319

Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via ".." sequences in the option parameter.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rgod.altervista.org/limbo1042_xpl.html	Exploit Vendor Advisory
http://secunia.com/advisories/18063/	Patch Vendor Advisory
http://securityreason.com/securityalert/255
http://securitytracker.com/id?1015364	Exploit
http://www.osvdb.org/21755
http://www.securityfocus.com/archive/1/419470/100/0/threaded
http://www.securityfocus.com/bid/15871/	Exploit Patch
http://www.vupen.com/english/advisories/2005/2932

Configurations

Configuration 1 (hide)

cpe:2.3:a:limbo_cms:limbo_cms:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2005-12-17 11:03

Updated : 2023-12-10 10:28

NVD link : CVE-2005-4319

Mitre link : CVE-2005-4319

CVE.ORG link : CVE-2005-4319

JSON object : View

Products Affected

limbo_cms

limbo_cms

CWE

NVD-CWE-Other

{"id": "CVE-2005-4319", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-12-17T11:03:00.000", "references": [{"url": "http://rgod.altervista.org/limbo1042_xpl.html", "tags": ["Exploit", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/18063/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/255", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1015364", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/21755", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/419470/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/15871/", "tags": ["Exploit", "Patch"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2005/2932", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in index2.php in Limbo CMS 1.0.4.2 and earlier allows remote attackers to include arbitrary PHP files via \"..\" sequences in the option parameter."}, {"lang": "es", "value": "Vulnerabilidad de traves\u00eda de directorios en index2.php en Limbo CMS 1.0.4.2 y anteriores permite a atacantes remotos incluir ficheros PHP de su elecci\u00f3n mediante secuencias \"..\" en el par\u00e1metro \"option\""}], "lastModified": "2018-10-19T15:40:47.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:limbo_cms:limbo_cms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "598E2FCD-D74E-4386-B18F-E50E1898990C", "versionEndIncluding": "1.0.4.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}