« Volver al listado

CVE-2008-6519

Estado: ModificadaAlta (10)—

Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Long Running Web Process (LRWP) request, which triggers incorrect logging code involving the sendfmt function in the SMT kernel.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Imatix — Xitami

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-6519",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-03-25T18:30:00.280",
  "references": [
    {
      "url": "http://www.bratax.be/advisories/b013.html",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/28603",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41644",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/5354",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.bratax.be/advisories/b013.html",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/28603",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41644",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/5354",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Long Running Web Process (LRWP) request, which triggers incorrect logging code involving the sendfmt function in the SMT kernel."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de formato de cadena en Xitami Web Server v2.2a hasta v2.5c2, y posiblemente otras versiones, permite a atacantes remotos provocar una denegación de servicio (caída del demonio) y posiblemente ejecutar código de su elección a través de especificadores de formato de cadena en una petición de proceso de larga ejecución Web (LRWP), lo que lanza  un código de validación de usuario incorrecto que involucra a la función \"sendfmt\" en el kernel SMT."
    }
  ],
  "lastModified": "2026-06-16T23:02:22.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:imatix:xitami:2.2a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96C0A1F6-9876-42AD-8B28-4E2306555DF5"
            },
            {
              "criteria": "cpe:2.3:a:imatix:xitami:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DE649DA-2818-4E06-9BD5-EBBD4A6B3861"
            },
            {
              "criteria": "cpe:2.3:a:imatix:xitami:2.4d7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C295F4D-B9E1-433A-BF3C-E74071FA18FB"
            },
            {
              "criteria": "cpe:2.3:a:imatix:xitami:2.4d7:*:windows:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D0EC8E9-20BC-4547-B341-9C5CB4A79CE0"
            },
            {
              "criteria": "cpe:2.3:a:imatix:xitami:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3DE159E-C488-4354-B571-C1DE0D920819"
            },
            {
              "criteria": "cpe:2.3:a:imatix:xitami:2.5c2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B49FD0B7-1DB7-4DC0-A3ED-E4034B7FAEDB"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}