CVE-2001-1049

Phorecast PHP script before 0.40 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html	Patch Vendor Advisory
http://www.securityfocus.com/bid/3388	Vendor Advisory
http://phorecast.org/
http://www.iss.net/security_center/static/7215.php

Configurations

Configuration 1 (hide)

cpe:2.3:a:paul_m._jones:phorecast:*:*:*:*:*:*:*:*

Information

Published : 2001-10-01 21:00

Updated : 2008-09-10 12:09

NVD link : CVE-2001-1049

Mitre link : CVE-2001-1049

JSON object : View

CWE

NVD-CWE-Other

Products Affected

paul_m._jones

phorecast

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2001-10/0012.html", "name": "20011002 results of semi-automatic source code audit", "tags": ["Patch", "Vendor Advisory"], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/bid/3388", "name": "3388", "tags": ["Vendor Advisory"], "refsource": "BID"}, {"url": "http://phorecast.org/", "name": "http://phorecast.org/", "tags": [], "refsource": "CONFIRM"}, {"url": "http://www.iss.net/security_center/static/7215.php", "name": "php-includedir-code-execution(7215)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Phorecast PHP script before 0.40 allows remote attackers to include arbitrary files from remote web sites via an HTTP request that sets the includedir variable."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2001-1049", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2001-10-02T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:paul_m._jones:phorecast:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.40"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-10T19:09Z"}

7.5 /10