github - ghsa-fqmg-328x-p2v7

GHSA-FQMG-328X-P2V7

Vulnerability from github – Published: 2022-05-17 00:37 – Updated: 2022-05-17 00:37

Details

Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\users.txt.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2008-6938"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-08-11T21:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\\users.txt.",
  "id": "GHSA-fqmg-328x-p2v7",
  "modified": "2022-05-17T00:37:19Z",
  "published": "2022-05-17T00:37:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6938"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46600"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/7109"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2008-11/0171.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/32696"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/49998"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/49999"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/498575"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/498602"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/498770"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/498771"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/498865"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/32287"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2008-6938 (GCVE-0-2008-6938)

Vulnerability from cvelistv5 – Published: 2009-08-11 20:25 – Updated: 2024-08-07 11:49

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://www.securityfocus.com/archive/1/498771	mailing-listx_refsource_BUGTRAQ
	http://www.osvdb.org/49999	vdb-entryx_refsource_OSVDB
	http://www.securityfocus.com/bid/32287	vdb-entryx_refsource_BID
	http://www.securityfocus.com/archive/1/498575	mailing-listx_refsource_BUGTRAQ
	http://www.securityfocus.com/archive/1/498770	mailing-listx_refsource_BUGTRAQ
	http://www.securityfocus.com/archive/1/498602	mailing-listx_refsource_BUGTRAQ
	http://archives.neohapsis.com/archives/bugtraq/20…	mailing-listx_refsource_BUGTRAQ
	http://secunia.com/advisories/32696	third-party-advisoryx_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
	http://www.osvdb.org/49998	vdb-entryx_refsource_OSVDB
	http://www.securityfocus.com/archive/1/498865	mailing-listx_refsource_BUGTRAQ
	https://www.exploit-db.com/exploits/7109	exploitx_refsource_EXPLOIT-DB

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T11:49:02.467Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20081201 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498771"
          },
          {
            "name": "49999",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/49999"
          },
          {
            "name": "32287",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/32287"
          },
          {
            "name": "20081122 Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498575"
          },
          {
            "name": "20081130 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498770"
          },
          {
            "name": "20081124 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498602"
          },
          {
            "name": "20081122 Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/bugtraq/2008-11/0171.html"
          },
          {
            "name": "32696",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32696"
          },
          {
            "name": "pi3web-isapi-dos(46600)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46600"
          },
          {
            "name": "49998",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/49998"
          },
          {
            "name": "20081203 Re: Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/498865"
          },
          {
            "name": "7109",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/7109"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-11-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\\users.txt."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20081201 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498771"
        },
        {
          "name": "49999",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/49999"
        },
        {
          "name": "32287",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/32287"
        },
        {
          "name": "20081122 Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498575"
        },
        {
          "name": "20081130 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498770"
        },
        {
          "name": "20081124 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498602"
        },
        {
          "name": "20081122 Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://archives.neohapsis.com/archives/bugtraq/2008-11/0171.html"
        },
        {
          "name": "32696",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32696"
        },
        {
          "name": "pi3web-isapi-dos(46600)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46600"
        },
        {
          "name": "49998",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/49998"
        },
        {
          "name": "20081203 Re: Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/498865"
        },
        {
          "name": "7109",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/7109"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-6938",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop application and without using the Pi3Web/Conf/Intenet.pi3, allows remote attackers to cause a denial of service (crash or hang) and obtain the full pathname of the server via a request to a file in the ISAPI directory that is not an executable DLL, which triggers the crash when the DLL load fails, as demonstrated using Isapi\\users.txt."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20081201 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498771"
            },
            {
              "name": "49999",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/49999"
            },
            {
              "name": "32287",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/32287"
            },
            {
              "name": "20081122 Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498575"
            },
            {
              "name": "20081130 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498770"
            },
            {
              "name": "20081124 Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498602"
            },
            {
              "name": "20081122 Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://archives.neohapsis.com/archives/bugtraq/2008-11/0171.html"
            },
            {
              "name": "32696",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32696"
            },
            {
              "name": "pi3web-isapi-dos(46600)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46600"
            },
            {
              "name": "49998",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/49998"
            },
            {
              "name": "20081203 Re: Re: Re: Wrong report: BID 32287, Pi3Web ISAPI DoS vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/498865"
            },
            {
              "name": "7109",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/7109"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-6938",
    "datePublished": "2009-08-11T20:25:00",
    "dateReserved": "2009-08-11T00:00:00",
    "dateUpdated": "2024-08-07T11:49:02.467Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-FQMG-328X-P2V7

CVE-2008-6938 (GCVE-0-2008-6938)

Tags

Sightings

Nomenclature