CVE-2010-5281

{"id": "CVE-2010-5281", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-11-26T23:55:00.923", "references": [{"url": "http://packetstormsecurity.org/1009-exploits/cmscout209-lfi.txt", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/41634", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.johnleitch.net/Vulnerabilities/CMScout.2.09.IBrowser.TinyMCE.Plugin.Local.File.Inclusion/33", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/68247", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62066", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in ibrowser.php in the CMScout 2.09 IBrowser TinyMCE Plugin 1.4.1, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "Vulnerabilidad de salto de directorio en ibrowser.php en el Plugin iBrowser TinyMCE v1.4.1 para CMScout 2.09 , cuando magic_quotes_gpc est\u00e1 desactivado, permite a atacantes remotos leer archivos de su elecci\u00f3n a trav\u00e9s de un .. (punto punto) en el par\u00e1metro lang. NOTA: algunos de estos detalles han sido obtenidos a partir de informaci\u00f3n de terceros.\r\n"}], "lastModified": "2017-08-29T01:29:14.470", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:net4visions:ibrowser:1.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CCF27BBD-CD9E-4472-BAFE-B59E139D3014"}], "operator": "OR"}]}], "evaluatorImpact": "Per: http://secunia.com/advisories/41634\r\n\r\n'1) Input passed via the \"lang\" parameter to e.g. ibrowser.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal sequences and URL-encoded NULL bytes.\r\n\r\nSuccessful exploitation of this vulnerability requires that \"magic_quotes_gpc\" is disabled.'", "sourceIdentifier": "cve@mitre.org"}