PT-2004-3637 · Netiq · Netiq Webtrends Reporting Center Enterprise Edition

Oliver Karow · Publicado 2004-12-31 · Atualizado 2018-10-19 · CVE-2004-2748

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetIQ WebTrends Reporting Center Enterprise Edition version 6.1a

Description The issue allows remote attackers to determine the installation path of the software. This is achieved by providing an invalid profileid parameter, which results in an error message that leaks the pathname.

Recommendations For version 6.1a, avoid using the profileid parameter in the viewreport.pl script until a fix is available. As a temporary workaround, consider restricting access to the viewreport.pl script to minimize the risk of exploitation.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2004-2748

Produtos afetados

Netiq Webtrends Reporting Center Enterprise Edition

Referências · 8

• 🔥 https://exploit-db.com/exploits/23559 · Exploit
• http://securityfocus.com/bid/9460 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2748 · Nota de Segurança
• http://secunia.com/advisories/10689 · Aviso do Fabricante
• http://securitytracker.com/id?1008799 · Nota
• http://securityreason.com/securityalert/3354 · Nota
• http://securityfocus.com/archive/1/350419/30/21610/threaded · Nota
• http://osvdb.org/3680 · Nota