CVE-2018-10245

{"id": "CVE-2018-10245", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2018-04-20T17:29:00.243", "references": [{"url": "https://github.com/theyiyibest/AWStatsFullPathDisclosure", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/theyiyibest/AWStatsFullPathDisclosure", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the server, a similar issue to CVE-2006-3682. The attack can, for example, use the awstats.pl framename and update parameters."}, {"lang": "es", "value": "Una vulnerabilidad de divulgaci\u00f3n de ruta completa en AWStats, hasta la versi\u00f3n 7.6, permite que atacantes remotos sepan d\u00f3nde est\u00e1 alojado el archivo de configuraci\u00f3n, lo que les permite obtener la ruta completa del servidor. Este problema es similar a CVE-2006-3682. El ataque puede, por ejemplo, emplear los par\u00e1metros framename y update en awstats.pl."}], "lastModified": "2024-11-21T03:41:06.093", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E6C81FF-D807-4161-B7C3-06E66A2EDBE6", "versionEndIncluding": "7.6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}