CVE-2008-0167
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by...
CVE-2008-0167 is a medium vulnerability (CVSS 4.6) in Gforge, published May 14, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in gforge 4.5.14-22etch8.
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
Exploit likelihood
What each source reports
NVD Score used
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
- Record
CVE-2008-0167- CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
- Record
CVE-2008-0167- Updated
- 2026-11-02
EUVDEUVD-2008-0179 No score
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
- Record
EUVD-2008-0179- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8p2-vhrj-74p5 No score
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by...
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
- Record
GHSA-w8p2-vhrj-74p5- Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gforgeDebian:4.0 |
before 4.5.14-22etch8, plus listed versions 4.5.14-224.5.14-22etch14.5.14-22etch24.5.14-22etch34.5.14-22etch44.5.14-22etch54.5.14-22etch64.5.14-22etch7 |
4.5.14-22etch8 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | phpQLAdmin 2.2.7 - Multiple Remote File Inclusions | 2008-02-22 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/29215
secunia.com/advisories/30286
security.debian.org/pool/updates/main/g/gforge/gforge_4.5.14-22etch8.diff.gz
vupen.com/english/advisories/2008/1537/references
debian.org/security/2008/dsa-1577
exchange.xforce.ibmcloud.com/vulnerabilities/42456
nvd.nist.gov/vuln/detail/CVE-2008-0167
github.com/advisories/GHSA-w8p2-vhrj-74p5