CVE-2011-4804

EPSS 24.3%

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 24.3%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

14 Dec 2011Published on NVD

21 Jan 2012Public PoC

Weaponization speed

38 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/36598unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://foobla.com/news/latest/obsuggest-1.8-security-release.html http://secunia.com/advisories/46844 http://www.securityfocus.com/bid/48944