PT-2004-2853 · Postnuke · Postnuke

Janek Vind

+1

·

Publicado

2004-04-21

·

Atualizado

2017-07-11

·

CVE-2004-1956

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions PostNuke version 0.7.2.6
Description The issue allows remote attackers to gain information via a direct HTTP request to specific files and directories, which reveals the path to the web server in a PHP error message. The affected directories and modules include includes/blocks, pnadodb, NS-NewUser, NS-Your Account, NS-LostPassword, and NS-User.
Recommendations For PostNuke version 0.7.2.6, restrict access to the includes/blocks, pnadodb, NS-NewUser, NS-Your Account, NS-LostPassword, and NS-User modules to minimize the risk of exploitation. Consider implementing proper error handling to prevent the disclosure of sensitive information, such as the web server path.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2004-1956

Produtos afetados

Postnuke