2.1low
CVE-2004-2398
Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine vali…
Published 21 y ago · modified 4 mo ago · JSON
CVSS
2.1
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 28%
Public exploits
0
none known
Summary
Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid usernames and conduct brute force attacks by reading the file names from /var/lib/mysql, which is assigned world-readable permissions by cPanel 9.3.0 R5.
Exploit prediction (EPSS)
0.34% probability of exploitation in the next 30 days, higher than 28% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/16197 · vdb-entry, x_refsource_XF, x_transferred
- archives.neohapsis.com /archives/bugtraq/2004-05/0206.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/10390 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2004-2398
- NVD: CVE-2004-2398
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.