Vulnerability Description
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in (1) templates/ including (2) templates/deluxe/admincp/, (3) templates/corporate/admincp/, and (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; and (12) settings/.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Deluxebb | Deluxebb | 1.3 |
Related Weaknesses (CWE)
References
- http://www.exploit-db.com/exploits/10598Exploit
- http://www.securityfocus.com/bid/37448Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54975
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54978
- http://www.exploit-db.com/exploits/10598Exploit
- http://www.securityfocus.com/bid/37448Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54975
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54977
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54978
FAQ
What is CVE-2009-4465?
CVE-2009-4465 is a vulnerability with a CVSS score of 7.5 (HIGH). DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administra...
How severe is CVE-2009-4465?
CVE-2009-4465 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-4465?
Check the references section above for vendor advisories and patch information. Affected products include: Deluxebb Deluxebb.