CVE-2014-5111

medium · 5

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Multiple directory traversal vulnerabilities in Fonality trixbox allow remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter to (1) home/index.php, (2) asterisk_info/asterisk_info.php, (3) repo/repo.php, or (4) endpointcfg/endpointcfg.php in maint/modules/.

CVSS

21.6%

EPSS (exploit prob.)

98th

EPSS percentile

2014-07-28

Published

AV:N/AC:L/Au:N/C:P/I:N/A:N

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
netfortris	trixbox	all versions

Check a specific version with /api/v1/cve/match.

References

http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html
http://packetstormsecurity.com/files/127522/Trixbox-XSS-LFI-SQL-Injection-Code-Execution.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-5111