vulnwire
6.8med

CVE-2009-0729

Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary l…

Published 17 y ago · modified 4 mo ago · JSON

CVSS
6.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 75%
Public exploits
0
none known

Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to (1) modules/recent_poll_include.php, (2) modules/login_include.php, and (3) modules/statistics_include.php and (4) configuration.inc.php in includes/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Exploit prediction (EPSS)

1.51% probability of exploitation in the next 30 days, higher than 75% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

  • osvdb.org /52178 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /52177 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/48856 · vdb-entry, x_refsource_XF, x_transferred
  • osvdb.org /52175 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /52176 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /bid/33860 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/33983 · third-party-advisory, x_refsource_SECUNIA, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.