« Volver al listado

CVE-2014-10073

Estado: ModificadaAlta (7.5)—

The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Debian — Debian LinuxWpitchoune — Psensor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-10073",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-04-20T20:29:00.207",
  "references": [
    {
      "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=blob%3Bf=NEWS",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=48739caa745f9f8002e87af574f03e5dc6ae3447",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=8b10426dcc0246c1712a99460dd470dcb1cc4d9c",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=blob%3Bf=NEWS",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=48739caa745f9f8002e87af574f03e5dc6ae3447",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=8b10426dcc0246c1712a99460dd470dcb1cc4d9c",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory."
    },
    {
      "lang": "es",
      "value": "La función create_response en server/server.c en Psensor, en versiones anteriores a la 1.1.4, permite el salto de directorio debido a que carece de una comprobación para determinar si un archivo está bajo el directorio webserver o no."
    }
  ],
  "lastModified": "2026-06-17T00:04:11.383",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wpitchoune:psensor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BD0F58D-F198-4770-B1F5-DB449F6D7FA0",
              "versionEndExcluding": "1.1.4"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}