PT-2004-2871 · Pafiledb · Pafiledb

Darkbicho · Publicado 2004-04-27 · Atualizado 2017-07-11 · CVE-2004-1974

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions paFileDB version 3.1

Description The issue allows remote attackers to gain sensitive information via a direct request to various API endpoints, including "login.php", "category.php", "search.php", "main.php", "viewall.php", "download.php", "email.php", "file.php", "rate.php", or "stats.php". These endpoints reveal the path in an error message, potentially exposing sensitive information.

Recommendations For paFileDB version 3.1, consider restricting access to the mentioned API endpoints until a patch is available. As a temporary workaround, disable the display of error messages that reveal sensitive path information.

Correção

Identificadores relacionados

CVE-2004-1974

Produtos afetados

Pafiledb

Referências · 3

• http://marc.info/?l=bugtraq&m=108311096022485&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1974 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15990 · Nota