CVE-2004-0259
The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed HTTP Referer, as demonstrated using an application on the same web server that contains a cross-site scripting…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.06%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The check_referer() function in Formmail.php 5.0 and earlier allows remote attackers to bypass access restrictions via an empty or spoofed HTTP Referer, as demonstrated using an application on the same web server that contains a cross-site scripting (XSS) issue.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 2.06% probability · 80th percentile
- CISA KEV
- Not listed
- Affected
- joe lumbroso acks/formmail.php
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=107619109629629&w=2
- http://www.securityfocus.com/bid/9591Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15079
- http://marc.info/?l=bugtraq&m=107619109629629&w=2
- http://www.securityfocus.com/bid/9591Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15079
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.