vulnwire
6.8med

CVE-2005-3347

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and eg…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
0
none known

Multiple directory traversal vulnerabilities in index.php in phpSysInfo 2.4 and earlier, as used in phpgroupware 0.9.16 and earlier, and egrouwpware before 1.0.0.009, allow remote attackers to include arbitrary files via .. (dot dot) sequences in the (1) sensor_program parameter or the (2) _SERVER[HTTP_ACCEPT_LANGUAGE] parameter, which overwrites an internal variable, a variant of CVE-2003-0536. NOTE: due to a typo in an advisory, an issue in osh was inadvertently linked to this identifier; the proper identifier for the osh issue is CVE-2005-3346.

Exploit prediction (EPSS)

3.55% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • secunia.com /advisories/17616 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2005:212 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • securityfocus.com /bid/15396 · vdb-entry, x_refsource_BID, x_transferred
  • gentoo.org /security/en/glsa/glsa-200511-18.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityfocus.com /bid/15414 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/17698 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2005/dsa-898 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/17441 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/416543 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • debian.org /security/2005/dsa-897 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/17620 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/17584 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • hardened-php.net /advisory_212005.81.html · x_refsource_MISC, x_transferred
  • secunia.com /advisories/17570 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2005/dsa-899 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/17643 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/23107 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.