CVE-2010-4617 : Detail

CVE-2010-4617

Directory Traversal
A01-Broken Access Control
0.83%V3
Network
2010-12-29
18h00 +00:00
2017-08-16
12h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Directory traversal vulnerability in the JotLoader (com_jotloader) component 2.2.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the section parameter to index.php.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Metrics

Metrics Score Severity CVSS Vector Source
V2 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 15791

Publication date : 2010-12-19 23h00 +00:00
Author : v3n0m
EDB Verified : Yes

) ) ) ( ( ( ( ( ) ) ( /(( /( ( ( /( ( ( ( )\ ))\ ) )\ ))\ ) )\ ) ( /( ( /( )\())\()))\ ) )\()) )\ )\ )\ (()/(()/( ( (()/(()/((()/( )\()) )\()) ((_)((_)\(()/( ((_)((((_)( (((_)(((_)( /(_))(_)) )\ /(_))(_))/(_))(_)\|((_)\ __ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_)) _((_)_ ((_) \ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \| \| __| _ \ | |_ _|| \| | |/ / \ V / (_) || (_ |\ V / / _ \ | (__ / _ \ | /| |) | _|| / |__ | | | .` | ' < |_| \___/ \___| |_| /_/ \_\ \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\ .WEB.ID ----------------------------------------------------------------------- Joomla Component Jotloader 2.2.1 Local File Inclusion Vulnerability ----------------------------------------------------------------------- Author : v3n0m (v3n0m666[at]live[dot]com) Site : http://yogyacarderlink.web.id/ Date : December, 20-2010 Location : Jakarta, Indonesia Time Zone : GMT +7:00 Application : JotLoader License : GPLv2 Version : 2.2.1 Other versions may also be affected Vendor : http://www.kanich.net/radio/site/jotloader Google Dorks : inurl:com_jotloader Exploit & p0c _____________ **[LFI] http://127.0.0.1/[path]/index.php?option=com_jotloader&section=[LFI]%00 _________________________________________________ All YOGYACARDERLINK Crew & My Beloved Jovita Andy _________________________________________________

Products Mentioned

Configuraton 0

Kanich>>Com_jotloader >> Version 2.2.1

    Joomla>>Joomla\! >> Version *

    References

    http://www.exploit-db.com/exploits/15791
    Tags : exploit, x_refsource_EXPLOIT-DB