VulnerabilityModified
CVE-2014-9575
VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header.
MEDIUM 6.4EPSS 2.39%
Does this matter?
Lower severity and a low EPSS score (2.39%). Track it; it rarely justifies an emergency change on its own.
Description
VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 2.39% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- vdgsecurity/vdg sense
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.htmlExploit
- http://seclists.org/fulldisclosure/2014/Dec/76Exploit
- https://vdgsecurity.com/downloads/software/?file=1.+DIVA+2.3%2F2.+Changelog+2.3.16.txtVendor Advisory
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txtExploit
- http://packetstormsecurity.com/files/129656/VDG-Security-SENSE-2.3.13-File-Disclosure-Bypass-Buffer-Overflow.htmlExploit
- http://seclists.org/fulldisclosure/2014/Dec/76Exploit
- https://vdgsecurity.com/downloads/software/?file=1.+DIVA+2.3%2F2.+Changelog+2.3.16.txtVendor Advisory
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20141218-0_VDG_Security_SENSE_Multiple_critical_vulnerabilities_v10.txtExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.