CVE-2009-10005
HighCVSS 8.7Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.
Risk Assessment
An unauthenticated attacker can access sensitive system files, potentially leading to disclosure of credentials and other confidential information.
Recommendation
It is recommended to immediately update ContentKeeper Web Appliance to version 125.10 or later and restrict access to CGI endpoints.
Other vulnerabilities in ContentKeeper Web Appliance
Original NVD description (English source)
ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, allowing unauthenticated attackers to retrieve arbitrary files from the filesystem. By crafting a POST request to /cgi-bin/ck/mimencode with traversal and output parameters, attackers can read sensitive files such as /etc/passwd outside the webroot.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS