PT-2006-2496 · Activecampaign · Activecampaign Supporttrio

Publicado 2006-03-29 · Atualizado 2017-07-20 · CVE-2006-1488

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: ActiveCampaign SupportTrio version 2.5

Description: The issue allows remote attackers to obtain the full path of the server. This can be achieved through invalid parameters in specific actions: (1) article or (2) print parameters in a kb action to "index.php", or (3) an invalid category parameter to "modules/KB/pdf.php". The path is leaked in an error message.

Recommendations: For ActiveCampaign SupportTrio version 2.5, consider restricting access to the "index.php" and "modules/KB/pdf.php" files until a patch is available. As a temporary workaround, avoid using invalid article, print, or category parameters in the respective actions to minimize the risk of path leakage.

Correção

Identificadores relacionados

CVE-2006-1488

Produtos afetados

Activecampaign Supporttrio

Referências · 7

• http://pridels0.blogspot.com/2006/03/activecampaign-supporttrio-25-vuln.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-1488 · Nota de Segurança
• http://vupen.com/english/advisories/2006/1126 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25517 · Nota
• http://osvdb.org/24191 · Nota
• http://osvdb.org/24190 · Nota
• http://secunia.com/advisories/19431 · Aviso do Fabricante