CVE-2009-2134

pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html	Exploit
http://www.securityfocus.com/archive/1/504300/100/0/threaded
https://www.exploit-db.com/exploits/8941
http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html	Exploit
http://www.securityfocus.com/archive/1/504300/100/0/threaded
https://www.exploit-db.com/exploits/8941

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pivot:pivot:1.40.4:::::::*
	cpe:2.3:a:pivot:pivot:1.40.7:::::::*

History

21 Nov 2024, 01:04

Type	Values Removed	Values Added
References	~~() http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html - Exploit~~	() http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html - Exploit
References	~~() http://www.securityfocus.com/archive/1/504300/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/504300/100/0/threaded -
References	~~() https://www.exploit-db.com/exploits/8941 -~~	() https://www.exploit-db.com/exploits/8941 -

Information

Published : 2009-06-19 19:30

Updated : 2024-11-21 01:04

NVD link : CVE-2009-2134

Mitre link : CVE-2009-2134

CVE.ORG link : CVE-2009-2134

JSON object : View

Products Affected

pivot

pivot

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2009-2134", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-06-19T19:30:00.187", "references": [{"url": "http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/504300/100/0/threaded", "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/8941", "source": "cve@mitre.org"}, {"url": "http://forum.intern0t.net/intern0t-advisories/1119-intern0t-pivot-1-40-4-7-multiple-vulnerabilities.html", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/504300/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/8941", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to obtain sensitive information via an invalid url parameter, which reveals the installation path in an error message."}, {"lang": "es", "value": "pivot/tb.php en Pivot v1.40.4 y v1.40.7 permite a atacantes remotos obtener informaci\u00f3n sensible mediante un par\u00e1metro \"url\" inv\u00e1lido, revelando la ruta de instalaci\u00f3n en un mensaje de error."}], "lastModified": "2024-11-21T01:04:12.553", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pivot:pivot:1.40.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E253FAF-6007-4054-B5C9-2027AF79CC44"}, {"criteria": "cpe:2.3:a:pivot:pivot:1.40.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FD12249-43AF-4456-A6CF-040AC68272B5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}