CVE-2014-9575

VDG Security SENSE (formerly DIVA) before 2.3.15 allows remote attackers to bypass authentication, and consequently read and modify arbitrary plugin settings, via an encoded : (colon) character in the Authorization HTTP header.

CVSS v2.0 NVD

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

2.39% chance of exploitation in the next 30 days, 84th percentile

Published

2015-01-08

Updated

2024-09-16

Proof-of-concept exploits (1)

• http://seclists.org/fulldisclosure/2014/Dec/76

Security advisories

• https://vdgsecurity.com/downloads/software/?file=1.+DIVA+2.3%2F2.+Changelog+2.3.16.txt

References

• CVE Record
• NVD entry