PT-2005-2673 · Postnuke · Postnuke

Cxib8O3 + 1 · Publicado 2005-05-24 · Atualizado 2024-01-25 · CVE-2005-1698

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PostNuke versions 0.750 through 0.760RC3

Description The issue allows remote attackers to obtain sensitive information via direct requests to various files, including theme.php and Xanthia.php in the Xanthia module, multiple files in the pnblocks directory in the Blocks module, config.php in the NS-Multisites module, and xmlrpc.php. These requests can reveal the path in an error message.

Recommendations For PostNuke versions 0.750 through 0.760RC3, consider restricting access to the sensitive files and directories, such as the Xanthia module, Blocks module, NS-Multisites module, and the xmlrpc.php file, to minimize the risk of exploitation. As a temporary workaround, disable the execution of these files until a patch is available.

Correção

Enumeração de Fraquezas

CWE-425

Identificadores relacionados

CVE-2005-1698

Produtos afetados

Postnuke

Referências · 2

• http://marc.info/?l=bugtraq&m=111670506926649&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1698 · Nota de Segurança