6.8med
CVE-2008-65221 exploit
Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1…
Published 17 y ago · modified 4 mo ago · JSON
CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.9%
percentile 80%
Public exploits
1
Exploit-DB
Summary
Multiple directory traversal vulnerabilities in the RenderFile function in ContentRender.class.php in Terracotta (aka OpenTerracotta) 0.6.1, and possibly other versions, allow remote attackers to list arbitrary directories and read arbitrary files via a .. (dot dot) in the (1) CurrentDirectory and (2) File parameters to index.php.
Exploit prediction (EPSS)
1.90% probability of exploitation in the next 30 days, higher than 80% of all scored CVEs.
Exploits and detections
- EDB-31584 Terracotta - 'index.php' Local File Inclusion · webapps · 2008-04-01
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
- securityfocus.com /bid/28550 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /archive/1/490341/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/41572 · vdb-entry, x_refsource_XF, x_transferred
Sources
- CVE List: CVE-2008-6522
- NVD: CVE-2008-6522
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.