Vulnerability Details CVE-2006-5031
Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js filename.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.069
EPSS Ranking 90.9%
CVSS Severity
CVSS v2 Score 5.0
References
- http://cakeforge.org/frs/shownotes.php?release_id=134
- http://secunia.com/advisories/22040
- http://www.gulftech.org/?node=research&article_id=00114-09212006
- http://www.securityfocus.com/bid/20150
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29115
- http://cakeforge.org/frs/shownotes.php?release_id=134
- http://secunia.com/advisories/22040
- http://www.gulftech.org/?node=research&article_id=00114-09212006
- http://www.securityfocus.com/bid/20150
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29115
Products affected by CVE-2006-5031
-
cpe:2.3:a:cakephp:cakephp:1.0.1.2708
-
cpe:2.3:a:cakephp:cakephp:1.1.3.2967
-
cpe:2.3:a:cakephp:cakephp:1.1.4.3104
-
cpe:2.3:a:cakephp:cakephp:1.1.5.3148
-
cpe:2.3:a:cakephp:cakephp:1.1.6.3264
-
cpe:2.3:a:cakephp:cakephp:1.1.7.3363