CVE-2008-0167 json
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then w…
published 2008-05-18 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-0179
- cvss
- 4.6
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 54%
- public exploits
- 1
- Exploit-DB
Summary
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
Patch / fix
- debian.org/security/2008/dsa-1577 advisory
Timeline
- First public exploit (EDB-5173)
- Published
Exploit prediction
0.73% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-5173 phpQLAdmin 2.2.7 - Multiple Remote File Inclusions webapps, 2008-02-22
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-59 Improper Link Resolution Before File Access
References
-
debian.org
/security/2008/dsa-1577
vendor-advisory, patch
-
secunia.com
/advisories/30286
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30088
third-party-advisory, vendor-advisory
-
securityfocus.com
/bid/29215
vdb-entry
- security.debian.org /pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz
-
vupen.com
/english/advisories/2008/1537/references
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/42456
vdb-entry
Sources
- CVE List CVE-2008-0167
- NVD CVE-2008-0167
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.