PT-2002-2559 · Unknown · Image Display System

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-1837

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Image Display System (IDS) version 0.81

Description The issue allows remote attackers to determine the existence of arbitrary directories via ".." sequences in the album parameter. This is due to the getAlbumToDisplay function in idsShared.pm generating different error messages depending on whether the directory exists or not.

Recommendations For version 0.81, consider restricting access to the getAlbumToDisplay function until a patch is available. As a temporary workaround, avoid using the album parameter with ".." sequences in the affected API endpoint.

Exploit

Correção

Identificadores relacionados

CVE-2002-1837

Produtos afetados

Image Display System

Referências · 6

• 🔥 http://securityfocus.com/bid/4870 · Exploit
• 🔥 https://exploit-db.com/exploits/21487 · Exploit
• http://iss.net/security_center/static/9201.php · Nota
• http://online.securityfocus.com/archive/1/274433 · Nota
• http://ids.sourceforge.net/ChangeLog.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2002-1837 · Nota de Segurança