CVE-2004-2671 json
mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests, and certain requests with inv…
published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-2661
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
mod.php in eNdonesia 8.3 allows remote attackers to obtain sensitive information via certain direct requests, and certain requests with invalid parameter values, which reveal the path in various error messages, as demonstrated by the (1) mod and (2) cid parameters.
Exploit prediction
1.63% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- securityfocus.com http://www.securityfocus.com/archive/1/370855 referenced PoC, tagged "exploit" by a source, unverified
- echo.or.id http://echo.or.id/adv/adv02-y3dips-2004.txt referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/8507 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
securityfocus.com
/archive/1/370855
mailing-list, exploit, vendor-advisory
-
echo.or.id
/adv/adv02-y3dips-2004.txt
exploit, vendor-advisory
-
securityfocus.com
/bid/8507
vdb-entry, exploit, vendor-advisory
-
secunia.com
/advisories/12231
third-party-advisory, vendor-advisory
-
securitytracker.com
/id?1010864
vdb-entry, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/13042
vdb-entry
Sources
- CVE List CVE-2004-2671
- NVD CVE-2004-2671
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.