VulnerabilityModified
CVE-2009-0700
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct…
MEDIUM 4.0EPSS 2.51%
Does this matter?
Lower severity and a low EPSS score (2.51%). Track it; it rarely justifies an emergency change on its own.
Description
Plunet BusinessManager 4.1 and earlier allows remote authenticated users to bypass access restrictions and (1) read sensitive Customer or Order data via a modified Pfad parameter to pagesUTF8/Sys_DirAnzeige.jsp, or (2) list sensitive Jobs via a direct request to pagesUTF8/auftrag_job.jsp.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
- EPSS
- 2.51% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- plunet/business manager
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.htmlExploit
- http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html
- http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txtExploit
- http://www.securityfocus.com/bid/33153Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47794
- http://archives.neohapsis.com/archives/bugtraq/2009-01/0032.htmlExploit
- http://archives.neohapsis.com/archives/bugtraq/2009-01/0054.html
- http://www.securenetwork.it/ricerca/advisory/download/SN-2008-04.txtExploit
- http://www.securityfocus.com/bid/33153Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47794
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.