CVE-2010-2456
Multiple directory traversal vulnerabilities in index.php in Linker IMG 1.0 and earlier allow remote attackers to read and execute arbitrary local files via a URL in the (1) cook_lan cookie parameter ($lan_dir variable) or possibly (2) Sdb_type parameter.
Does this matter?
Lower severity and a low EPSS score (2.03%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple directory traversal vulnerabilities in index.php in Linker IMG 1.0 and earlier allow remote attackers to read and execute arbitrary local files via a URL in the (1) cook_lan cookie parameter ($lan_dir variable) or possibly (2) Sdb_type parameter. NOTE: this was originally reported as remote file inclusion, but this may be inaccurate.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 2.03% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- codelib/linker img
- Source
- cve@mitre.org
References
- http://packetstormsecurity.org/1006-exploits/linkerimg-rfi.txtExploit
- http://www.attrition.org/pipermail/vim/2010-June/002354.htmlExploit
- http://www.exploit-db.com/exploits/13964Exploit
- http://www.vupen.com/english/advisories/2010/1562Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59614
- http://packetstormsecurity.org/1006-exploits/linkerimg-rfi.txtExploit
- http://www.attrition.org/pipermail/vim/2010-June/002354.htmlExploit
- http://www.exploit-db.com/exploits/13964Exploit
- http://www.vupen.com/english/advisories/2010/1562Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59614
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.