vulnwire
5.0med

CVE-2006-0754

dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 78%
Public exploits
0
none known

dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php

Exploit prediction (EPSS)

1.76% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

References

  • osvdb.org /23206 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /archive/1/424957/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/24745 · vdb-entry, x_refsource_XF, x_transferred
  • secunia.com /advisories/18879 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/16648 · vdb-entry, x_refsource_BID, x_transferred
  • vupen.com /english/advisories/2006/0604 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/425285/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.