PT-2002-2445 · Unknown · Powerboards

Publicado 2002-12-31 · Atualizado 2017-07-11 · CVE-2002-1723

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Powerboards version 2.2b

Description The issue allows remote attackers to view the full path to the backend database. This can be achieved by sending a cookie containing a non-existent username to the "profiles.php" endpoint, which displays the full path in the error message.

Recommendations For Powerboards version 2.2b, consider restricting access to the "profiles.php" endpoint until a patch is available, or modify the error handling to prevent the disclosure of sensitive path information.

Correção

Identificadores relacionados

CVE-2002-1723

Produtos afetados

Powerboards

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-1723 · Nota de Segurança
• http://online.securityfocus.com/archive/82/266665 · Nota
• http://ifrance.com/kitetoua/tuto/powerboards.txt · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8824 · Nota