CVE-2013-3514

Multiple directory traversal vulnerabilities in OpenX before 2.8.10 revision 82710 allow remote administrators to read arbitrary files via a .. (dot dot) in the group parameter to (1) plugin-preferences.php or (2) plugin-settings.php in www/admin, a different vulnerability than CVE-2013-7376.  NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to read arbitrary files.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 91%
VendorProductVersion
openxopenx
𝑥
≤ 2.8.10
openxopenx
2.4
openxopenx
2.4.4
openxopenx
2.4.5
openxopenx
2.4.6
openxopenx
2.4.7
openxopenx
2.4.8
openxopenx
2.4.9
openxopenx
2.4.10
openxopenx
2.4.11
openxopenx
2.6.0
openxopenx
2.6.1
openxopenx
2.6.2
openxopenx
2.6.3
openxopenx
2.6.4
openxopenx
2.6.5
openxopenx
2.7.29
openxopenx
2.8
openxopenx
2.8.1
openxopenx
2.8.2
openxopenx
2.8.3
openxopenx
2.8.4
openxopenx
2.8.5
openxopenx
2.8.6
openxopenx
2.8.7
openxopenx
2.8.8
openxopenx
2.8.9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/94778
http://seclists.org/bugtraq/2013/Jul/27
https://www.htbridge.com/advisory/HTB23155
http://osvdb.org/94778
http://seclists.org/bugtraq/2013/Jul/27
https://www.htbridge.com/advisory/HTB23155