PT-2004-2487 · Cubecart · Cubecart

Pedro Sanches · Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-1579

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CubeCart version 2.0.1

Description The issue allows remote attackers to gain sensitive information via an HTTP request with an invalid cat id parameter, which reveals the full path in a PHP error message.

Recommendations For CubeCart version 2.0.1, consider validating and sanitizing the cat id parameter to prevent the disclosure of sensitive information. As a temporary workaround, restrict access to the index.php file until a patch is available.

Correção

Identificadores relacionados

CVE-2004-1579

Produtos afetados

Cubecart

Referências · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/17630 · Nota
• http://marc.info/?l=bugtraq&m=109713382400457&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1579 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1579 · Nota