CVE-2014-10079
Description
In Vembu StoreGrid 4.4.x, the front page of the server web interface leaks the private IP address in the "ipaddress" hidden form value of the HTML source code, which is disclosed because of incorrect processing of an index.php/ trailing slash.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"Incorrect processing of the index.php/ trailing slash causes the server to leak the private IP address in a hidden form field on the front page."
Attack vector
An unauthenticated attacker simply requests the front page of the Vembu StoreGrid web interface (typically on port 6061). Due to incorrect handling of the index.php/ trailing slash, the server's private IP address is embedded in the HTML source code inside a hidden form field named "ipaddress" around line 80 [ref_id=1][ref_id=2]. No authentication or special payload is required; the disclosure occurs on every normal page load.
Affected code
The vulnerability is in the front page of the Vembu StoreGrid web interface (version 4.4.0). The hidden form field "ipaddress" around line 80 of the HTML source leaks the private IP address due to incorrect processing of an index.php/ trailing slash [ref_id=1][ref_id=2]. No specific source file or function is named in the advisory.
What the fix does
No patch is included in the bundle. The advisory does not specify a fix, but the remediation would involve removing the private IP address from the hidden form field or ensuring the server does not leak internal addressing information in the HTML response. The vulnerability is present in Vembu StoreGrid version 4.4.0 [ref_id=1][ref_id=2].
Preconditions
- networkThe Vembu StoreGrid web interface must be accessible over the network (default port 6061).
- authNo authentication is required; the front page is publicly accessible.
Reproduction
1. Navigate to the Vembu StoreGrid web interface (e.g., https://target:6061/). 2. View the HTML source code of the front page. 3. Around line 80, locate the hidden form field named "ipaddress" which contains the server's private IP address [ref_id=1][ref_id=2].
Generated on May 26, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- www.exploit-db.com/exploits/46549/mitreexploitx_refsource_EXPLOIT-DB
- cxsecurity.com/issue/WLB-2018120091mitrex_refsource_MISC
- packetstormsecurity.com/files/127786/Vembu-Backup-Disaster-Recovery-6.1-Follow-Up.htmlmitrex_refsource_MISC
- seclists.org/fulldisclosure/2014/Aug/8mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.