Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the…
Priority LOW 33Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Agora.cgi 3.2r through 4.0 while in debug mode allows remote attackers to determine the full pathname of the agora.cgi file by requesting a non-existent .html file, which leaks the pathname in an error message.
Why it matters now
EPSS 0.07475 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2:*:*:*:*:*:*:* | 3.2 | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2a:*:*:*:*:*:*:* | 3.2a | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2b:*:*:*:*:*:*:* | 3.2b | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2c:*:*:*:*:*:*:* | 3.2c | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2d:*:*:*:*:*:*:* | 3.2d | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2e:*:*:*:*:*:*:* | 3.2e | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2f:*:*:*:*:*:*:* | 3.2f | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2g:*:*:*:*:*:*:* | 3.2g | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2h:*:*:*:*:*:*:* | 3.2h | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2i:*:*:*:*:*:*:* | 3.2i | Vulnerable | Steve Kneizys |
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2a:*:*:*:*:*:*:* Versions 3.2a Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2b:*:*:*:*:*:*:* Versions 3.2b Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2c:*:*:*:*:*:*:* Versions 3.2c Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2d:*:*:*:*:*:*:* Versions 3.2d Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2e:*:*:*:*:*:*:* Versions 3.2e Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2f:*:*:*:*:*:*:* Versions 3.2f Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2g:*:*:*:*:*:*:* Versions 3.2g Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2h:*:*:*:*:*:*:* Versions 3.2h Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2i:*:*:*:*:*:*:* Versions 3.2i Vulnerable ·Steve Kneizys
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2j:*:*:*:*:*:*:* | 3.2j | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2ja:*:*:*:*:*:*:* | 3.2ja | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2k:*:*:*:*:*:*:* | 3.2k | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2l:*:*:*:*:*:*:* | 3.2l | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2m:*:*:*:*:*:*:* | 3.2m | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2n:*:*:*:*:*:*:* | 3.2n | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2p:*:*:*:*:*:*:* | 3.2p | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2q:*:*:*:*:*:*:* | 3.2q | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.2r:*:*:*:*:*:*:* | 3.2r | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3a:*:*:*:*:*:*:* | 3.3a | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3b:*:*:*:*:*:*:* | 3.3b | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3c:*:*:*:*:*:*:* | 3.3c | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3d:*:*:*:*:*:*:* | 3.3d | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3e:*:*:*:*:*:*:* | 3.3e | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3f:*:*:*:*:*:*:* | 3.3f | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3i:*:*:*:*:*:*:* | 3.3i | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:3.3j:*:*:*:*:*:*:* | 3.3j | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:4.0a:*:*:*:*:*:*:* | 4.0a | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:4.0b:*:*:*:*:*:*:* | 4.0b | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:4.0c:*:*:*:*:*:*:* | 4.0c | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:4.0d:*:*:*:*:*:*:* | 4.0d | Vulnerable | Steve Kneizys |
| cpe:2.3:a:steve_kneizys:agora.cgi:4.0e:*:*:*:*:*:*:* | 4.0e | Vulnerable | Steve Kneizys |
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2j:*:*:*:*:*:*:* Versions 3.2j Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2ja:*:*:*:*:*:*:* Versions 3.2ja Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2k:*:*:*:*:*:*:* Versions 3.2k Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2l:*:*:*:*:*:*:* Versions 3.2l Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2m:*:*:*:*:*:*:* Versions 3.2m Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2n:*:*:*:*:*:*:* Versions 3.2n Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2p:*:*:*:*:*:*:* Versions 3.2p Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2q:*:*:*:*:*:*:* Versions 3.2q Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.2r:*:*:*:*:*:*:* Versions 3.2r Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3a:*:*:*:*:*:*:* Versions 3.3a Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3b:*:*:*:*:*:*:* Versions 3.3b Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3c:*:*:*:*:*:*:* Versions 3.3c Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3d:*:*:*:*:*:*:* Versions 3.3d Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3e:*:*:*:*:*:*:* Versions 3.3e Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3f:*:*:*:*:*:*:* Versions 3.3f Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3i:*:*:*:*:*:*:* Versions 3.3i Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:3.3j:*:*:*:*:*:*:* Versions 3.3j Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:4.0a:*:*:*:*:*:*:* Versions 4.0a Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:4.0b:*:*:*:*:*:*:* Versions 4.0b Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:4.0c:*:*:*:*:*:*:* Versions 4.0c Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:4.0d:*:*:*:*:*:*:* Versions 4.0d Vulnerable ·Steve Kneizys
- cpe:2.3:a:steve_kneizys:agora.cgi:4.0e:*:*:*:*:*:*:* Versions 4.0e Vulnerable ·Steve Kneizys
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2002-0215
- 2026-10-03 Alias added: GHSA-qxr3-vrv9-867m
References
Patch 1
More Steve Kneizys Agora.cgi vulnerabilities
- TI-2001-01152 Cross-site scripting vulnerability in agora.cgi for Agora 3.0a through 4.0g, when debug… CVSS 2.0HIGH 7.5
Sources
- CVE-2002-0215 · CVE Program
- CVE-2002-0215 · NVD
- FIRST EPSS
- GHSA-qxr3-vrv9-867m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences