CVE-2012-10024

HIGH EPSS 60.3%
Published Aug 5, 202510mo ago · Modified Jun 16, 20261w ago
7.1 CVSS 4.0
High
Find Similar
Published Aug 5, 2025 10mo ago
Last Modified Jun 16, 2026 1w ago

Description

XBMC version 11.0 contains a path traversal vulnerability in its embedded HTTP server. When accessed via HTTP Basic Authentication, the server fails to properly sanitize URI input, allowing authenticated users to request files outside the intended document root. An attacker can exploit this flaw to read arbitrary files from the host filesystem, including sensitive configuration or credential files.

CVSS Details

Base Score
7.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
60.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-22 Path Traversal Resource Mgmt

References 5

  • github.com https://github.com/xbmc/xbmc
  • github.com https://github.com/xbmc/xbmc/commit/bdff099c024521941cb0956fe01d99ab52a65335
  • raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/gather/xbmc_traversal.rb
  • ioactive.com https://www.ioactive.com/wp-content/uploads/pdfs/Security_Advisory_XBMC.pdf
  • vulncheck.com https://www.vulncheck.com/advisories/xbmc-web-server-path-traversal

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.