PT-2002-1352 · Dcp · Dcp-Portal

Publicado 2002-05-03 · Atualizado 2017-07-11 · CVE-2002-0282

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DCP-Portal versions 3.7 through 4.5

Description The issue allows remote attackers to obtain the physical path of the server. This can be achieved through a direct request to "add user.php" or by providing an invalid new language parameter in "contents.php", "categories.php", or "files.php", which results in the path being leaked in an error message.

Recommendations For versions 3.7 through 4.5, consider restricting access to the affected PHP files until a patch is available. As a temporary workaround, avoid using the new language parameter in the affected API endpoints.

Correção

Identificadores relacionados

CVE-2002-0282

Produtos afetados

Dcp-Portal

Referências · 7

• http://marc.info/?l=bugtraq&m=101494497608620&w=2 · Nota
• http://dcp-portal.com/files.php?action=viewcat&fcat_id=1 · Nota
• http://securityfocus.com/bid/4113 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-0282 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=101379160830631&w=2 · Nota
• http://iss.net/security_center/static/8310.php · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8196 · Nota