CVE-2015-4181

high-risk

Published 2017-08-25

Directory traversal vulnerability in get_file.php in phpMyBackupPro 2.1 through 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: this vulnerability exists due to an incomplete fix to CVE-2015-4180.

Do I need to act?

16.3% chance of exploitation in next 30 days

EPSS score — higher than 84% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

1 public exploit available

10169

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (5)

Phpmybackuppro

Affected Vendors

Phpmybackuppro

References (2)

Mailing List http://www.openwall.com/lists/oss-security/2015/06/04/10

/ 100

high-risk

Severity 26/34 · High

Exploitability 20/34 · Moderate

Exposure 12/34 · Low