CVE-2008-3555
Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote…
Does this matter?
Lower severity and a low EPSS score (1.93%). Track it; it rarely justifies an emergency change on its own.
Description
Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter, as demonstrated by uploading a .jpg file containing PHP sequences.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.93% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- wsn/forum · wsn/gallery · wsn/knowledge base · wsn/links
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/31392
- http://securityreason.com/securityalert/4120
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44236
- https://www.exploit-db.com/exploits/6208
- http://secunia.com/advisories/31392
- http://securityreason.com/securityalert/4120
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44236
- https://www.exploit-db.com/exploits/6208
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.