// For flags

CVE-2009-5068

Simple Machines Forum (SMF) 1.1.10/2.0 RC2 - Multiple Vulnerabilities

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesystem and therefore gain new privileges by reading the settings.php with the database passwords.

Hay una vulnerabilidad de divulgación de archivos en SMF (Simple Machines Forum) afectando a las versiones hasta la versión v2.0.3. En algunas configuraciones un despliegue SMF es compartido por varios "co-admins" en los que no se confía más allá del despliegue SMF. Esta vulnerabilidad les permite leer archivos arbitrarios en el sistema de archivos y, por lo tanto, alcanzar nuevos privilegios para leer los archivos settings.php con las contraseñas de la base de datos.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-12-02 First Exploit
  • 2011-04-05 CVE Reserved
  • 2020-01-15 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-312: Cleartext Storage of Sensitive Information
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Simplemachines
Search vendor "Simplemachines"
 Simple Machines Forum
Search vendor "Simplemachines" for product "Simple Machines Forum"
 <= 2.0.3
Search vendor "Simplemachines" for product "Simple Machines Forum" and version " <= 2.0.3"
-
Affected