VulnerabilityModified

CVE-2008-6938

MEDIUM 4.3EPSS 26.5%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 26.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS: 26.48% probability · 98th percentile
CISA KEV: Not listed
Weakness: CWE-20
Affected: holger zimmermann/pi3web
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.