VulnerabilityModified
CVE-2009-1064
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third…
MEDIUM 5.8EPSS 3.72%
Does this matter?
Lower severity and a low EPSS score (3.72%). Track it; it rarely justifies an emergency change on its own.
Description
Argument injection vulnerability in orbitmxt.dll 2.1.0.2 in the Orbit Downloader 2.8.7 and earlier ActiveX control allows remote attackers to overwrite arbitrary files via whitespace and a command-line switch, followed by a full pathname, in the third argument to the download method.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
- EPSS
- 3.72% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- orbit downloader/orbit downloader · orbitdownloader/orbit downloader
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/34200
- http://www.waraxe.us/advisory-73.htmlExploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49353
- https://www.exploit-db.com/exploits/8257
- http://www.securityfocus.com/bid/34200
- http://www.waraxe.us/advisory-73.htmlExploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49353
- https://www.exploit-db.com/exploits/8257
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.