VulnerabilityModified
CVE-2009-2166
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.
MEDIUM 5.0EPSS 3.19%
Does this matter?
Lower severity and a low EPSS score (3.19%). Track it; it rarely justifies an emergency change on its own.
Description
Absolute path traversal vulnerability in cvs.php in OCS Inventory NG before 1.02.1 on Unix allows remote attackers to read arbitrary files via a full pathname in the log parameter.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 3.19% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- ocsinventory-ng/ocs inventory ng
- Source
- cve@mitre.org
References
- http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_directory_traversal.shtmlExploit
- http://www.securityfocus.com/archive/1/504047/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50946
- https://www.exploit-db.com/exploits/8868
- http://www.leidecker.info/advisories/2009-05-30-ocs_inventory_ng_directory_traversal.shtmlExploit
- http://www.securityfocus.com/archive/1/504047/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/50946
- https://www.exploit-db.com/exploits/8868
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.