FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to foot_news.php, which triggers an infinite loop, or (2) direct requests to unknown scripts, which reveals the web document root in an error message.

Threat-Mapped Scoring

Score: 3.1

Priority: P2 - Serious (High)

• S1 – Steal Customer Account Information
• S10 – Denial of Service (+0.1 bonus)

EPSS

Score: 0.01029
Percentile: 0.76373

CVSS Scoring

Mapped CWE(s)

• CWE-425 : Direct Request ('Forced Browsing')

All CAPEC(s)

CAPEC(s) with Mapped TTPs

Mapped ATT&CK TTPs

• T1083 : File and Directory Discovery
  Kill Chain: discovery
• T1565.002 : Transmitted Data Manipulation
  Kill Chain: impact

Malware

APTs Threat Group Associations

Campaigns

Affected Products

• cpe:2.3:a:flatnuke:flatnuke:*:*:*:*:*:*:*:*

← Back to Home