CVE-2008-7212 - Vulnerability Details - OpenCVE

MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Brilaps	Mostlyce
Mambo-foundation	Mambo

Configuration 1 [-]

AND

OR	cpe:2.3:a:mambo-foundation:mambo::::::::
	cpe:2.3:a:mambo-foundation:mambo:4.6.2:::::::*

cpe:2.3:a:brilaps:mostlyce:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
http://forum.mambo-foundation.org/showthread.php?t=10158
http://osvdb.org/42529
http://secunia.com/advisories/28670
http://www.bugreport.ir/index_33.htm
http://www.securityfocus.com/archive/1/487128/100/200/threaded
http://www.vupen.com/english/advisories/2008/0325
https://exchange.xforce.ibmcloud.com/vulnerabilities/39983

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2009-09-11T16:00:00

Updated: 2024-08-07T11:56:14.483Z

Reserved: 2009-09-11T00:00:00

Link: CVE-2008-7212

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2009-09-11T16:30:00.453

Modified: 2025-04-09T00:30:58.490

Link: CVE-2008-7212

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-01-28T00:00:00", "descriptions": [{"lang": "en", "value": "MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-11T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "ADV-2008-0325", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"name": "mambo-mostlyce-connector-path-disclosure(39983)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39983"}, {"name": "20080227 Re: Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"name": "28670", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/28670"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"name": "20080128 Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://www.bugreport.ir/index_33.htm"}, {"name": "42529", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/42529"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-7212", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "ADV-2008-0325", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"name": "mambo-mostlyce-connector-path-disclosure(39983)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39983"}, {"name": "20080227 Re: Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"name": "28670", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/28670"}, {"name": "http://forum.mambo-foundation.org/showthread.php?t=10158", "refsource": "CONFIRM", "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"name": "20080128 Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"name": "http://www.bugreport.ir/index_33.htm", "refsource": "MISC", "url": "http://www.bugreport.ir/index_33.htm"}, {"name": "42529", "refsource": "OSVDB", "url": "http://osvdb.org/42529"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T11:56:14.483Z"}, "title": "CVE Program Container", "references": [{"name": "ADV-2008-0325", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"name": "mambo-mostlyce-connector-path-disclosure(39983)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39983"}, {"name": "20080227 Re: Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"name": "28670", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/28670"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"name": "20080128 Mambo 4.6.3 Path Disclosure, XSS , XSRF, DOS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.bugreport.ir/index_33.htm"}, {"name": "42529", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/42529"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-7212", "datePublished": "2009-09-11T16:00:00", "dateReserved": "2009-09-11T00:00:00", "dateUpdated": "2024-08-07T11:56:14.483Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mambo-foundation:mambo:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D2DE818-7FEA-48ED-BD22-A8760C1F297F", "versionEndIncluding": "4.6.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mambo-foundation:mambo:4.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "97BAB160-6BB4-4535-BA60-B25303793FBD", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:brilaps:mostlyce:*:*:*:*:*:*:*:*", "matchCriteriaId": "295DA818-1660-4534-A153-2F416C66D2D0", "versionEndIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php, which reveals the installation path in an error message."}, {"lang": "es", "value": "MOStlyCE anteriores a la v2.4, como la usada en Mambo v4.6.3 y anteriores, permiten a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de determinadas peticiones sobre mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php el cual revela el path de instalaci\u00f3n en un mensaje de error."}], "id": "CVE-2008-7212", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-09-11T16:30:00.453", "references": [{"source": "cve@mitre.org", "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"source": "cve@mitre.org", "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://osvdb.org/42529"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/28670"}, {"source": "cve@mitre.org", "url": "http://www.bugreport.ir/index_33.htm"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39983"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://forum.mambo-foundation.org/showthread.php?t=10158"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://osvdb.org/42529"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/28670"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.bugreport.ir/index_33.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/487128/100/200/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2008/0325"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39983"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}