CVE-2008-5645

Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP GET request.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/32592
http://marc.info/?l=full-disclosure&m=122606860208526&w=2	Exploit
http://www.securityfocus.com/bid/32187	Patch
http://securityreason.com/securityalert/4773
http://www.vupen.com/english/advisories/2008/3082
https://exchange.xforce.ibmcloud.com/vulnerabilities/46461

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:orb_networks:orb:2.01.0013:::::::*
	cpe:2.3:a:orb_networks:orb:2.01.0008:::::::*
	cpe:2.3:a:orb_networks:orb:2.0.1014:::::::*
	cpe:2.3:a:orb_networks:orb::::::::
	cpe:2.3:a:orb_networks:orb:2.00.0930:::::::*
	cpe:2.3:a:orb_networks:orb:2.00.0989:::::::*
	cpe:2.3:a:orb_networks:orb:2.00.1014:::::::*
	cpe:2.3:a:orb_networks:orb:2.00.1084:::::::*
	cpe:2.3:a:orb_networks:orb:2.01.0015:::::::*

Information

Published : 2008-12-17 10:30

Updated : 2017-08-07 18:33

NVD link : CVE-2008-5645

Mitre link : CVE-2008-5645

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

Products Affected

orb_networks

orb

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/advisories/32592", "name": "32592", "tags": [], "refsource": "SECUNIA"}, {"url": "http://marc.info/?l=full-disclosure&m=122606860208526&w=2", "name": "20081106 DDIVRT-2008-17 Orb Directory Traversal", "tags": ["Exploit"], "refsource": "FULLDISC"}, {"url": "http://www.securityfocus.com/bid/32187", "name": "32187", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://securityreason.com/securityalert/4773", "name": "4773", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2008/3082", "name": "ADV-2008-3082", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46461", "name": "orb-unspecified-directory-traversal(46461)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP GET request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-5645", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2008-12-17T18:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.01.0013:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.01.0008:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.0.1014:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.01.0017"}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.00.0930:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.00.0989:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.00.1014:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.00.1084:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:orb_networks:orb:2.01.0015:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-08T01:33Z"}