2.1

CVE-2008-2517

Exploit
The sarab.sh script in SaraB before 0.2.4 places the dar program's encryption key on the command line, which allows local users to obtain sensitive information by listing the process.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Sarab ≫ Sarab Version <= 0.2.3
Sarab ≫ Sarab Version0.2.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.18
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?r1=34&r2=36
Exploit
http://sarab.svn.sourceforge.net/viewvc/sarab/sarab/sarab.sh?view=log
http://secunia.com/advisories/30394
Vendor Advisory
http://sourceforge.net/project/shownotes.php?release_id=601603&group_id=91804
http://www.securityfocus.com/bid/29364
http://www.vupen.com/english/advisories/2008/1659/references
https://exchange.xforce.ibmcloud.com/vulnerabilities/42621