vulnwire
7.2high

CVE-2000-06801 exploit

The CVS 1.10.8 server does not properly restrict users from creating arbitrary Checkin.prog or Update.prog programs, which allows remote CV…

Published 26 y ago · modified 4 mo ago · JSON

CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
1
Exploit-DB

The CVS 1.10.8 server does not properly restrict users from creating arbitrary Checkin.prog or Update.prog programs, which allows remote CVS committers to modify or create Trojan horse programs with the Checkin.prog or Update.prog names, then performing a CVS commit action.

Exploit prediction (EPSS)

1.34% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.

Exploits and detections

  • EDB-20108 CVS Kit CVS Server 1.10.8 - 'Checkin.prog' Binary Execution · local · 2000-06-28

CVSS scores

Assigned byVersionScoreVector
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

References

  • securityfocus.com /frames/?content=/templates/archive.pike%3Flist%3D1%26msg%3Dhvou2daoebb.fsf%40serein.m17n. · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • securityfocus.com /bid/1524 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.