RIPS Scanner v0.54 Path Traversal
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.7epss 2.1%
exploitation probability
2.1%top 19% of all CVEs
observed exploitation
nono source reports it
A path traversal vulnerability exists in RIPS Scanner version 0.54. The vulnerability allows remote attackers to read arbitrary files on the system with the privileges of the web server by sending crafted HTTP GET requests to the 'windows/code.php' script with a manipulated 'file' parameter. This can lead to disclosure of sensitive information.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
RIPS Technologies · RIPS ScannerReferences
https://codesec.blogspot.com/2015/03/rips-scanner-v-054-local-file-include.htmlhttps://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/rips_traversal.rbhttps://rips-scanner.sourceforge.net/https://www.exploit-db.com/exploits/18660https://www.vulncheck.com/advisories/rips-scanner-path-traversal