Unscored severity · published Jun 18, 2009
CVE-2009-2109
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) language parameter to…
–
CVSS
9.5%
EPSS
No
On KEV
Description
Multiple directory traversal vulnerabilities in FretsWeb 1.2 allow remote attackers to read arbitrary files via directory traversal sequences in the (1) language parameter to charts.php and the (2) fretsweb_language cookie parameter to unspecified vectors, possibly related to admin/common.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
Fretsweb · Fretsweb Project
1.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2109
Broken Link
http://osvdb.org/55166
Broken Link
http://osvdb.org/55196
Vendor Advisory
http://secunia.com/advisories/35492
Third Party Advisory
https://www.exploit-db.com/exploits/8979
More from Fretsweb
–
CVE-2009-2113
Multiple SQL injection vulnerabilities in FretsWeb 1.2 allow remote attackers to execute arbitrary SQL commands via the (1) name parameter to player.php and the (2) hash parameter…