CVE-2008-6592

{"id": "CVE-2008-6592", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-04-03T18:30:00.377", "references": [{"url": "http://secunia.com/advisories/29833", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/44674", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/491064/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/28801", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49851", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/5452", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/29833", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/44674", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/491064/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/28801", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49851", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/5452", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy \"no database\" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte)."}, {"lang": "es", "value": "thumbsup.php en Thumbs-Up v1.12, cuando se utiliza en LightNEasy \"no database\" (tambi\u00e9n conocido como flat) y SQLite v1.2.2 permite a atacantes remotos copiar, renombrar, y leer ficheros de modo arbitrario a trav\u00e9s de secuencias de salto de directorio en el par\u00e1metro \"image\" con un par\u00e1metro modificado cache_dir conteniendo un %00 (byte codificado nulo)."}], "lastModified": "2024-11-21T00:56:56.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lightneasy:lightneasy:1.2.2:*:no_database:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F76F72FB-D3CE-4229-93B1-FE0A021972B0"}, {"criteria": "cpe:2.3:a:sqlite:sqlite:1.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65EA4824-622E-4A2E-969F-05AF2C5B1F8C"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}