exploitDog

CVE-2008-6938

Опубликовано: 11 авг. 2009

Источник: nvd

CVSS2: 4.3

EPSS Высокий

Описание

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:holger_zimmermann:pi3web:*:*:*:*:*:*:*:*

Версия до 2.0.3_pl1 (включая)

cpe:2.3:a:holger_zimmermann:pi3web:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:holger_zimmermann:pi3web:2.0:*:*:*:*:*:*:*

cpe:2.3:a:holger_zimmermann:pi3web:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:holger_zimmermann:pi3web:2.0.2_beta_1:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.73687

Высокий

4.3 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-fqmg-328x-p2v7

github

больше 3 лет назад

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.

EPSS

Процентиль: 99%

0.73687

Высокий

4.3 Medium

CVSS2

Дефекты

CWE-20