PT-2002-2754 · Faqmanager · Faqmanager

Publicado 2002-12-31 · Atualizado 2008-09-05 · CVE-2002-2033

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FAQManager versions 2.2.5 and earlier

Description The issue allows remote attackers to read arbitrary files by specifying the filename in the toc parameter with a trailing null character (%00).

Recommendations For FAQManager versions 2.2.5 and earlier, consider restricting access to the faqmanager.cgi script until a patch is available. As a temporary workaround, avoid using the toc parameter with a trailing null character (%00) to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-2033

Produtos afetados

Faqmanager

Referências · 4

• http://iss.net/security_center/static/7833.php · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2002-2033 · Nota de Segurança
• http://securityfocus.com/bid/3810 · Correção
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0065.html · Correção