PT-2006-1472 · Note A Day · Note-A-Day Weblog

Publicado 2006-01-25 · Atualizado 2017-07-20 · CVE-2006-0404

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Note-A-Day Weblog version 2.2

Description The issue allows remote attackers to obtain sensitive information due to insufficient access control of sensitive data stored under the web document root. This can be achieved via a direct request to the "archive/.phpass-admin" endpoint, which contains encrypted passwords.

Recommendations For Note-A-Day Weblog version 2.2, restrict access to the "archive/.phpass-admin" endpoint to minimize the risk of exploitation. Consider implementing proper access controls for sensitive data stored under the web document root.

Exploit

Correção

Identificadores relacionados

CVE-2006-0404

Produtos afetados

Note-A-Day Weblog

Referências · 9

• 🔥 http://evuln.com/vulns/44/summary.html · Exploit
• http://osvdb.org/22699 · Nota
• http://securitytracker.com/id?1015539 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24270 · Nota
• http://archives.neohapsis.com/archives/bugtraq/2006-01/0389.html · Nota
• http://securityreason.com/securityalert/371 · Nota
• http://vupen.com/english/advisories/2006/0299 · Nota
• http://secunia.com/advisories/18566 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-0404 · Nota de Segurança