Directory traversal vulnerability in the media server in Orb Networks Orb before…
Priority LOW 38CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Complete · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Directory traversal vulnerability in the media server in Orb Networks Orb before 2.01.0022 allows remote attackers to read arbitrary files via directory traversal sequences in an HTTP GET request.
Why it matters now
EPSS 0.0218 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:orb_networks:orb:*:*:*:*:*:*:*:* | up to 2.01.0017 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.00.0930:*:*:*:*:*:*:* | 2.00.0930 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.00.0989:*:*:*:*:*:*:* | 2.00.0989 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.0.1014:*:*:*:*:*:*:* | 2.0.1014 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.00.1014:*:*:*:*:*:*:* | 2.00.1014 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.00.1084:*:*:*:*:*:*:* | 2.00.1084 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.01.0008:*:*:*:*:*:*:* | 2.01.0008 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.01.0013:*:*:*:*:*:*:* | 2.01.0013 | Vulnerable | Orb Networks |
| cpe:2.3:a:orb_networks:orb:2.01.0015:*:*:*:*:*:*:* | 2.01.0015 | Vulnerable | Orb Networks |
- cpe:2.3:a:orb_networks:orb:*:*:*:*:*:*:*:* Versions up to 2.01.0017 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.00.0930:*:*:*:*:*:*:* Versions 2.00.0930 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.00.0989:*:*:*:*:*:*:* Versions 2.00.0989 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.0.1014:*:*:*:*:*:*:* Versions 2.0.1014 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.00.1014:*:*:*:*:*:*:* Versions 2.00.1014 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.00.1084:*:*:*:*:*:*:* Versions 2.00.1084 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.01.0008:*:*:*:*:*:*:* Versions 2.01.0008 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.01.0013:*:*:*:*:*:*:* Versions 2.01.0013 Vulnerable ·Orb Networks
- cpe:2.3:a:orb_networks:orb:2.01.0015:*:*:*:*:*:*:* Versions 2.01.0015 Vulnerable ·Orb Networks
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-5645
- 2026-10-03 Alias added: GHSA-fcgq-cmjc-xp98
References
More Orb Networks Orb vulnerabilities
- TI-2008-05280 Unspecified vulnerability in the media server in Orb Networks Orb before 2.01.0025 allows… CVSS 2.0MEDIUM 5.0
- TI-2008-00061 Integer overflow in Orb Networks Orb 2.00.1014 and Winamp Remote BETA allows remote… CVSS 2.0MEDIUM 4.6
Sources
- CVE-2008-5645 · CVE Program
- CVE-2008-5645 · NVD
- FIRST EPSS
- GHSA-fcgq-cmjc-xp98 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences