Unscored severity · published Mar 6, 2009
CVE-2008-6440
Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cerberus Helpdesk before 4.0 (Build 600) allows remote attackers to obtain sensitive information via direct requests for "controllers ... that aren't standard helpdesk pages," possibly involving the (1) /display and (2) /kb URIs.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Cerberus Helpdesk · Cerberus
2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-6440
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-6440
Vendor Advisory
http://secunia.com/advisories/30344
Vendor Advisory
http://www.cerb4.com/blog/2008/05/15/important-security-patch-40-build-599/
www.securityfocus.com
http://www.securityfocus.com/bid/29335
More from Cerberus Helpdesk
–
CVE-2006-5428
rpc.php in Cerberus Helpdesk 3.2.1 does not verify a client's privileges for a display_get_requesters operation, which allows remote attackers to bypass the GUI login and obtain…
–
CVE-2006-4539
(1) includes/widgets/module_company_tickets.php and (2) includes/widgets/module_track_tickets.php Client Support Center in Cerberus Helpdesk 3.2 Build 317, and possibly earlier,…
–
CVE-2006-0509
Multiple cross-site scripting (XSS) vulnerabilities in clients.php in Cerberus Helpdesk, possibly 2.7, allow remote attackers to inject arbitrary web script or HTML via (1) the…
–
CVE-2005-4428
Cross-site scripting (XSS) vulnerability in index.php in Cerberus Helpdesk allows remote attackers to inject arbitrary web script or HTML via the kb_ask parameter
–
CVE-2005-4427
Multiple SQL injection vulnerabilities in Cerberus Helpdesk allow remote attackers to execute arbitrary SQL commands via the (1) file_id parameter to attachment_send.php, (2) the…