CVE-2014-10073 - Vulnerability Details - OpenCVE

Description

The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory.

Published: 2018-04-20

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:wpitchoune:psensor:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-1361-1	psensor security update
EUVD	EUVD-2014-1140	The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00335.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=blob%3Bf=NEWS
http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=48739caa745f9f8002e87af574f03e5dc6ae3447
http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=8b10426dcc0246c1712a99460dd470dcb1cc4d9c
https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html

History

No history.

Subscriptions

Debian Debian Linux

Wpitchoune Psensor

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-04-20T20:00:00.000Z

Updated: 2024-08-06T14:02:38.306Z

Reserved: 2018-04-20T00:00:00.000Z

Link: CVE-2014-10073

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-04-20T20:29:00.207

Modified: 2024-11-21T02:03:27.690

Link: CVE-2014-10073

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-22

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-04-20T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-04-25T09:57:01.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[debian-lts-announce] 20180424 [SECURITY] [DLA 1361-1] psensor security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=blob%3Bf=NEWS"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=8b10426dcc0246c1712a99460dd470dcb1cc4d9c"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=48739caa745f9f8002e87af574f03e5dc6ae3447"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-10073", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[debian-lts-announce] 20180424 [SECURITY] [DLA 1361-1] psensor security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html"}, {"name": "http://git.wpitchoune.net/gitweb/?p=psensor.git;a=blob;f=NEWS", "refsource": "CONFIRM", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git;a=blob;f=NEWS"}, {"name": "http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=8b10426dcc0246c1712a99460dd470dcb1cc4d9c", "refsource": "CONFIRM", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=8b10426dcc0246c1712a99460dd470dcb1cc4d9c"}, {"name": "http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=48739caa745f9f8002e87af574f03e5dc6ae3447", "refsource": "CONFIRM", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=48739caa745f9f8002e87af574f03e5dc6ae3447"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T14:02:38.306Z"}, "title": "CVE Program Container", "references": [{"name": "[debian-lts-announce] 20180424 [SECURITY] [DLA 1361-1] psensor security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=blob%3Bf=NEWS"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=8b10426dcc0246c1712a99460dd470dcb1cc4d9c"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=48739caa745f9f8002e87af574f03e5dc6ae3447"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-10073", "datePublished": "2018-04-20T20:00:00.000Z", "dateReserved": "2018-04-20T00:00:00.000Z", "dateUpdated": "2024-08-06T14:02:38.306Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpitchoune:psensor:*:*:*:*:*:*:*:*", "matchCriteriaId": "8BD0F58D-F198-4770-B1F5-DB449F6D7FA0", "versionEndExcluding": "1.1.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory."}, {"lang": "es", "value": "La funci\u00f3n create_response en server/server.c en Psensor, en versiones anteriores a la 1.1.4, permite el salto de directorio debido a que carece de una comprobaci\u00f3n para determinar si un archivo est\u00e1 bajo el directorio webserver o no."}], "id": "CVE-2014-10073", "lastModified": "2024-11-21T02:03:27.690", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-04-20T20:29:00.207", "references": [{"source": "cve@mitre.org", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=blob%3Bf=NEWS"}, {"source": "cve@mitre.org", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=48739caa745f9f8002e87af574f03e5dc6ae3447"}, {"source": "cve@mitre.org", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=8b10426dcc0246c1712a99460dd470dcb1cc4d9c"}, {"source": "cve@mitre.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=blob%3Bf=NEWS"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=48739caa745f9f8002e87af574f03e5dc6ae3447"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://git.wpitchoune.net/gitweb/?p=psensor.git%3Ba=commit%3Bh=8b10426dcc0246c1712a99460dd470dcb1cc4d9c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}