CVE-2009-0729
Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to (1) modules/recent_poll_include.php, (2)…
Does this matter?
Lower severity and a low EPSS score (1.51%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to (1) modules/recent_poll_include.php, (2) modules/login_include.php, and (3) modules/statistics_include.php and (4) configuration.inc.php in includes/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.51% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- lingx/page engine cms
- Source
- cve@mitre.org
References
- http://osvdb.org/52175
- http://osvdb.org/52176
- http://osvdb.org/52177
- http://osvdb.org/52178
- http://secunia.com/advisories/33983Vendor Advisory
- http://www.securityfocus.com/bid/33860
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48856
- http://osvdb.org/52175
- http://osvdb.org/52176
- http://osvdb.org/52177
- http://osvdb.org/52178
- http://secunia.com/advisories/33983Vendor Advisory
- http://www.securityfocus.com/bid/33860
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48856
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.