CVE-2010-5078

SilverStripe 2.3.x before 2.3.10 and 2.4.x before 2.4.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain version information via a direct request to (1) apphire/silverstripe_version or (2) cms/silverstripe_version.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
silverstripesilverstripe
2.3.0
silverstripesilverstripe
2.3.1
silverstripesilverstripe
2.3.2
silverstripesilverstripe
2.3.3
silverstripesilverstripe
2.3.4
silverstripesilverstripe
2.3.5
silverstripesilverstripe
2.3.6
silverstripesilverstripe
2.3.7
silverstripesilverstripe
2.3.8
silverstripesilverstripe
2.3.9
silverstripesilverstripe
2.4.0
silverstripesilverstripe
2.4.1
silverstripesilverstripe
2.4.2
silverstripesilverstripe
2.4.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10
http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4
http://open.silverstripe.org/ticket/5031
http://secunia.com/advisories/42346
http://www.openwall.com/lists/oss-security/2011/01/03/12
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
http://www.openwall.com/lists/oss-security/2012/05/01/3
http://www.osvdb.org/69888
http://www.securityfocus.com/bid/45367
https://exchange.xforce.ibmcloud.com/vulnerabilities/63990
http://doc.silverstripe.org/framework/en/trunk/changelogs//2.3.10
http://doc.silverstripe.org/framework/en/trunk/changelogs//2.4.4
http://open.silverstripe.org/ticket/5031
http://secunia.com/advisories/42346
http://www.openwall.com/lists/oss-security/2011/01/03/12
http://www.openwall.com/lists/oss-security/2012/04/30/1
http://www.openwall.com/lists/oss-security/2012/04/30/3
http://www.openwall.com/lists/oss-security/2012/05/01/3
http://www.osvdb.org/69888
http://www.securityfocus.com/bid/45367
https://exchange.xforce.ibmcloud.com/vulnerabilities/63990