Vulnerability Details : CVE-2011-0435
Domain Technologie Control (DTC) before 0.32.9 does not require authentication for (1) admin/bw_per_month.php and (2) client/bw_per_month.php, which allows remote attackers to obtain potentially sensitive bandwidth information via a direct request.
Products affected by CVE-2011-0435
- cpe:2.3:a:gplhost:domain_technologie_control:*:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.27.3:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.26.9:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.1:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.10:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.3:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.2:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.26.8:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.26.7:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.9:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.8:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.25.2:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.25.3:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.16:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.28.4:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.25.1:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.10:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.18:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.17:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.15:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.14:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.24.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.5:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.30.20:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.1:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.8:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.10:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.29.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.4:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.7:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.6:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.2:*:*:*:*:*:*:*
- cpe:2.3:a:gplhost:domain_technologie_control:0.32.3:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2011-0435
0.83%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2011-0435
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2011-0435
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-0435
-
http://secunia.com/advisories/43523
Sign inVendor Advisory
-
http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.32.10-1/changelog
404 Not Found
-
http://www.debian.org/security/2011/dsa-2179
Debian -- Security Information -- DSA-2179-1 dtc
-
http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=e94e8b9cc354bfcaeb284d5331b815256bb46162
-
http://packages.debian.org/changelogs/pool/main/d/dtc/dtc_0.29.17-1+lenny1/changelog
404 Not Found
-
http://www.vupen.com/english/advisories/2011/0556
Webmail | OVH- OVHVendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/65896
Domain Technologie Control bw_per_month.php information disclosure CVE-2011-0435 Vulnerability Report
-
http://git.gplhost.com/gitweb/?p=dtc.git;a=commit;h=e94e8b9cc354bfcaeb284d5331b815256bb46162
Patch
-
http://www.gplhost.sg/lists/dtcannounce/msg00025.html
Fwd: [SECURITY] [DSA 2179-1] dtc security updatePatch
-
http://git.gplhost.com/gitweb/?p=dtc.git%3Ba=commit%3Bh=89da9c519b04cda1b23e6290d2b0a6cea1bae31e
-
http://git.gplhost.com/gitweb/?p=dtc.git;a=commit;h=89da9c519b04cda1b23e6290d2b0a6cea1bae31e
Patch
Jump to