6.5med
CVE-2008-2139
The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session…
Published 18 y ago · modified 4 mo ago · JSON
CVSS
6.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 30%
Public exploits
0
none known
Summary
The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with a valid administrator session, including requests to change the password, which makes it easier for physically proximate attackers to gain privileges and maintain control over the administrator account.
Exploit prediction (EPSS)
0.36% probability of exploitation in the next 30 days, higher than 30% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:A/AC:H/Au:S/C:C/I:C/A:C |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- exchange.xforce.ibmcloud.com /vulnerabilities/42394 · vdb-entry, x_refsource_XF, x_transferred
- wiki.rpath.com /wiki/Advisories:rPSA-2008-0148 · x_refsource_CONFIRM, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/42393 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2008-2139
- NVD: CVE-2008-2139
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.