« Volver al listado

CVE-2006-1149

Estado: ModificadaAlta (7.5)—

PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

OWL — OWL Intranet Engine

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-1149",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-03-10T11:02:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/19142",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/23734",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/17021",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0868",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25082",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/1561",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/19142",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/23734",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/17021",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0868",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/25082",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/1561",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PHP remote file inclusion vulnerability in lib/OWL_API.php in OWL Intranet Engine 0.82, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the xrms_file_root parameter, which is not initialized before use."
    }
  ],
  "lastModified": "2026-06-16T22:22:06.970",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:owl:owl_intranet_engine:0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3012FBFA-B0A6-407F-AADB-F4AEA6080798"
            },
            {
              "criteria": "cpe:2.3:a:owl:owl_intranet_engine:0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BB6B7DE-D724-43FE-BECF-73E7E778A872"
            },
            {
              "criteria": "cpe:2.3:a:owl:owl_intranet_engine:0.72:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "228741CF-B9B1-4025-8325-66F10CC75748"
            },
            {
              "criteria": "cpe:2.3:a:owl:owl_intranet_engine:0.73:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F34C0CBE-9AB2-4723-B996-1BE7D7A2DDBE"
            },
            {
              "criteria": "cpe:2.3:a:owl:owl_intranet_engine:0.82:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D99C7E0-66D3-4E38-B5EB-153067BB164B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}