VulnerabilityModified
CVE-2009-2115
admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message.
MEDIUM 6.8EPSS 1.13%
Does this matter?
Lower severity and a low EPSS score (1.13%). Track it; it rarely justifies an emergency change on its own.
Description
admin.php in SkyBlueCanvas 1.1 r237 allows remote authenticated administrators to obtain sensitive information via an invalid id parameter, which reveals the installation path in an error message.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:L/Au:S/C:C/I:N/A:N
- EPSS
- 1.13% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- skybluecanvas/skybluecanvas
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/35478Vendor Advisory
- http://www.securityfocus.com/archive/1/504302/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51164
- http://secunia.com/advisories/35478Vendor Advisory
- http://www.securityfocus.com/archive/1/504302/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51164
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.