« Volver al listado

CVE-2009-4231

Estado: ModificadaAlta (7.5)—

Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. (dot dot) in the plugin parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Basic-cms — Sweetrice

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4231",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-12-08T19:30:00.280",
  "references": [
    {
      "url": "http://packetstormsecurity.org/0911-exploits/sweetrice-rfilfi.txt",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.org/0911-exploits/sweetrice-rfilfi.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in as/lib/plugins.php in SweetRice 0.5.3 and earlier allows remote attackers to include and execute arbitrary local files via .. (dot dot) in the plugin parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en as/lib/plugins.php en SweetRice v0.5.3 y anteriores permite a atacantes incluir y ejecutar archivos locales a su elección a través de ... (punto punto) en el parámetro plugin."
    }
  ],
  "lastModified": "2026-06-16T23:13:17.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AB2DBC1-CA10-4E31-A8A6-F46577F08094",
              "versionEndIncluding": "0.5.3"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7C3FD9D9-48F8-4C17-89EF-A670674A4D98"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DA71DE1A-221F-4F8C-AC25-846EC63EA6DB"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7910F921-A7E1-4174-9FA5-DE715A837034"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E2660BC-E28A-4E46-9E12-8278793B246B"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "49EDB825-A30A-4154-8C97-E5440541A0BD"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36D342A2-AAAC-45E7-89FE-404DDC5E9190"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0206166-41EF-4BE1-8767-8E5ACFFB0375"
            },
            {
              "criteria": "cpe:2.3:a:basic-cms:sweetrice:0.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C4668D0C-E52E-4F48-84ED-66F519E8E235"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}