CVE-2008-0231

Estado: ModificadaAlta (7.5)—

Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via ".." sequences in the page parameter. NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments.

CVSS

Versión: 2.0
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.51%
Percentil entre todas las CVEs puntuadas: 84
Fecha de la puntuación: 3/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (7)

Tuned Studios — Classic Theme Tuned Studios — Endless Tuned Studios — Freeze Theme Tuned Studios — Lonely Maple Tuned Studios — Music Theme Tuned Studios — Orange Cutout Tuned Studios — Subwoofer

CWE

CWE-22

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2008-0231",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": true,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-01-11T00:46:00.000",
  "references": [
    {
      "url": "http://securityreason.com/securityalert/3532",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/485991/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/27196",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39555",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4876",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/3532",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/485991/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27196",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39555",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/4876",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple directory traversal vulnerabilities in index.php in Tuned Studios (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, and (7) Music Theme webpage templates allow remote attackers to include and execute arbitrary files via \"..\" sequences in the page parameter.  NOTE: this can be leveraged for remote file inclusion when running in some PHP 5 environments."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de salto de directorio en el archivo index.php en las plantillas de páginas web de Tuned Studios: (1) Subwoofer, (2) Freeze Theme, (3) Orange Cutout, (4) Lonely Maple, (5) Endless, (6) Classic Theme, y (7) Music Theme, permiten a atacantes remotos incluir y ejecutar archivos arbitrarios por medio de secuencias \"..\" en el parámetro page. NOTA: esto puede ser aprovechado para la inclusión de archivos remota cuando se ejecuta en algunos entornos PHP 5."
    }
  ],
  "lastModified": "2026-06-16T22:49:11.163",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tuned_studios:classic_theme:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B039A91A-CD08-4797-BCC8-26CCA314B3FB"
            },
            {
              "criteria": "cpe:2.3:a:tuned_studios:endless:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "14A4ADC9-9FF0-4FD8-A0EB-D9A00EC4D489"
            },
            {
              "criteria": "cpe:2.3:a:tuned_studios:freeze_theme:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "899816A8-C7E8-41E3-B915-6560DFFC8640"
            },
            {
              "criteria": "cpe:2.3:a:tuned_studios:lonely_maple:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FD526F0-FA78-45E9-AB9A-8D14B510D204"
            },
            {
              "criteria": "cpe:2.3:a:tuned_studios:music_theme:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46B54A5E-D11C-4ACD-AB76-37B7D77B13E7"
            },
            {
              "criteria": "cpe:2.3:a:tuned_studios:orange_cutout:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E042281B-A23C-4D1C-8988-08AC480F499F"
            },
            {
              "criteria": "cpe:2.3:a:tuned_studios:subwoofer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "93467A28-7A77-468F-B625-6F6383656728"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}