PT-2005-5044 · Phpbb · Phpbb

Cxib8O3 + 1 · Publicado 2005-12-20 · Atualizado 2018-10-19 · CVE-2005-4358

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.18

Description The issue allows remote attackers to obtain the installation path of phpBB. This is achieved by making a direct request to the 'admin/admin disallow.php' endpoint with a non-empty setmodules parameter. The request causes an invalid append sid function call, resulting in the installation path being leaked in an error message.

Recommendations For phpBB version 2.0.18, consider restricting access to the 'admin/admin disallow.php' endpoint until a fix is available. As a temporary workaround, avoid using the setmodules parameter in requests to this endpoint to minimize the risk of path disclosure.

Correção

Identificadores relacionados

CVE-2005-4358

Produtos afetados

Phpbb

Referências · 12

• https://nvd.nist.gov/vuln/detail/CVE-2005-4358 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4358 · Nota
• http://securityfocus.com/archive/1/420537/100/0/threaded · Nota
• http://osvdb.org/21804 · Nota
• http://secunia.com/advisories/18252 · Aviso do Fabricante
• http://phpbb.com/phpBB/viewtopic.php?f=14&t=352966 · Nota
• http://marc.info/?l=full-disclosure&m=113484567432679&w=2 · Nota
• http://securityreason.com/achievement_securityalert/29 · Nota
• http://secunia.com/advisories/18125 · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2991 · Nota
• http://securityreason.com/securityalert/269 · Nota
• http://vupen.com/english/advisories/2006/0010 · Nota