PT-2002-1497 · Black Tie · Black Tie Project

Publicado 2002-06-11 · Atualizado 2008-09-05 · CVE-2002-0446

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Black Tie Project (BTP) versions 0.4b through 0.5b

Description The issue allows remote attackers to determine the absolute path of the web server via an invalid cid parameter in the categorie.php3 file, which leaks the pathname in an error message.

Recommendations For Black Tie Project (BTP) versions 0.4b through 0.5b, consider validating and sanitizing the cid parameter to prevent the disclosure of the web server's absolute path. As a temporary workaround, restrict access to the categorie.php3 file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

Identificadores relacionados

CVE-2002-0446

Produtos afetados

Black Tie Project

Referências · 4

• 🔥 http://securityfocus.com/bid/4275 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-0446 · Nota de Segurança
• http://securityfocus.com/archive/1/261681 · Aviso do Fabricante
• http://iss.net/security_center/static/8439.php · Aviso do Fabricante