Quantum Secular Labs / Blog / Advisories
CVE-2000-0010: Tony Greenwood Webwho+: Command injection
CVE-2000-0010 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Tony Greenwood Webwho+. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.
Vulnerability description
WebWho+ whois.cgi program allows remote attackers to execute commands via shell metacharacters in the TLD parameter.
Severity breakdown
CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C
- Access vector: Network. Exploitable remotely over the network.
- Access complexity: Low. No special conditions are required.
- Authentication: None. No authentication is needed.
- Confidentiality impact: Complete. Total information disclosure.
- Integrity impact: Complete. Total loss of integrity.
- Availability impact: Complete. Total shutdown of the component.
Affected products
- Tony Greenwood Webwho+: 1.1