CVE-2005-4700

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-31 · updated 2026-06-16

Description

TellMe 1.2 and earlier, when the Server (o_Server) and HEAD (o_Head) options are enabled, allows remote attackers to obtain sensitive information via an invalid q_Host parameter, which reveals the full pathname of the application in an fsockopen error message.

Affected products

Tellme: 1.2

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0107.html
http://exploitlabs.com/files/advisories/EXPL-A-2005-015-tellme.txt
http://secunia.com/advisories/17078
http://www.osvdb.org/19872
https://exchange.xforce.ibmcloud.com/vulnerabilities/22523
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0107.html
http://exploitlabs.com/files/advisories/EXPL-A-2005-015-tellme.txt
http://secunia.com/advisories/17078
http://www.osvdb.org/19872
https://exchange.xforce.ibmcloud.com/vulnerabilities/22523

Get alerted when CVE-2005-4700 or the next vulnerability affects your stack