VulnerabilityModified
CVE-2010-0123
The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a "semi-predictable…
MEDIUM 5.0EPSS 1.26%
Does this matter?
Lower severity and a low EPSS score (1.26%). Track it; it rarely justifies an emergency change on its own.
Description
The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a "semi-predictable file name."
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.26% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- timeclock-software/employee timeclock software
- Source
- PSIRT-CNA@flexerasoftware.com
References
- http://secunia.com/advisories/38739Vendor Advisory
- http://secunia.com/secunia_research/2010-10/Vendor Advisory
- http://www.osvdb.org/62833
- http://www.securityfocus.com/archive/1/509990/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56798
- http://secunia.com/advisories/38739Vendor Advisory
- http://secunia.com/secunia_research/2010-10/Vendor Advisory
- http://www.osvdb.org/62833
- http://www.securityfocus.com/archive/1/509990/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56798
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.