CVE-2014-5086
moderate-risk
Published 2020-02-10
A Command Execution vulnerability exists in Sphider Pro, and Sphider Plus 3.2 due to insufficient sanitization of fwrite to conf.php, which could let a remote malicious user execute arbitrary code. CVE-2014-5086 pertains to instances of fwrite in Sphider Pro and Sphider Plus only, but don’t exist in Sphider.
Do I need to act?
~
6.7% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10
High
NETWORK
/ LOW complexity
Affected Products (3)
Sphider
Sphider-Plus
Sphider Pro
Affected Vendors
48
/ 100
moderate-risk
Severity
30/34 · Critical
Exploitability
9/34 · Low
Exposure
9/34 · Low