« Volver al listado

CVE-2008-4490

Estado: ModificadaMedia (5.1)—

Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the userInfo cookie.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Phpabook — Phpabook

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4490",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-10-08T02:00:01.597",
  "references": [
    {
      "url": "http://securityreason.com/securityalert/4364",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/31581",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45680",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6679",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/4364",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/31581",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45680",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/6679",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in config.inc.php in phpAbook 0.8.8b and earlier, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the userInfo cookie."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en el archivo config.inc.php en phpAbook 0.8.8b y versiones anteriores, cuando magic_quotes_gpc es deshabilitado, permite a los atacantes remotos incluir y ejecutar arbitrariamente archivos a través de .. (punto punto) en la cookie userInfo."
    }
  ],
  "lastModified": "2026-06-16T22:57:54.743",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpabook:phpabook:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94F86FC9-BA87-4A3C-9131-76535366380C",
              "versionEndIncluding": "0.8.8b"
            },
            {
              "criteria": "cpe:2.3:a:phpabook:phpabook:0.8.4b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E3D2349-7E26-481C-BB7D-53DC25DBCE61"
            },
            {
              "criteria": "cpe:2.3:a:phpabook:phpabook:0.8.6b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3ED7309-73BA-4606-8E39-2C7D696E70B2"
            },
            {
              "criteria": "cpe:2.3:a:phpabook:phpabook:0.8.7b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "177BE709-B457-434E-80EB-CDC8A3BA9602"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}