PT-2004-1809 · Phpbb · Phpbb

Janek Vind + 1 · Publicado 2004-07-23 · Atualizado 2017-07-11 · CVE-2004-0729

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.8

Description The issue allows remote attackers to gain sensitive information. This is achieved by providing an invalid parameter to certain API endpoints, which then reveal the full path in an error message. Specifically, this can be done through the category rows parameter to "index.php", the faq parameter to "faq.php", or the ranksrow parameter to "profile.php".

Recommendations For phpBB version 2.0.8, consider restricting access to the vulnerable API endpoints "index.php", "faq.php", and "profile.php" until a fix is available. As a temporary workaround, avoid using the category rows, faq, and ranksrow parameters in these endpoints to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2004-0729

Produtos afetados

Phpbb

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/16720 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0729 · Nota
• http://waraxe.us/index.php?modname=sa&id=34 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16716 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0729 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=108999024506020&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16723 · Nota