Unscored severity · published Feb 23, 2006
CVE-2006-0869
Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote…
–
CVSS
4%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier allows remote attackers to determine file existence, and possibly delete arbitrary files with short pathnames or possibly read arbitrary files, via a .. (dot dot) in the store_id value of a cookie.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Pear Liveuser · Pear
0.3; 0.5; 0.5.1; 0.6; 0.6.1; 0.7; +23 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0869
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0869
Patch
http://pear.php.net/package/LiveUser/download/
securityreason.com
http://securityreason.com/securityalert/466
Patch
http://securitytracker.com/id?1015659
Vendor Advisory
http://www.gulftech.org/?node=research&article_id=00103-02212006
www.securityfocus.com
http://www.securityfocus.com/archive/1/425711/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/16761