PT-2006-3274 · Eserv · Eserv/3

Tan Chew Keong · Publicado 2006-06-02 · Atualizado 2018-10-18 · CVE-2006-2309

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions EServ/3 version 3.25

Description The issue allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot, space, and slash characters, which reveals the source code of script files.

Recommendations For EServ/3 version 3.25, consider restricting access to the HTTP service until a patch is available. As a temporary workaround, avoid using the HTTP service with crafted requests containing dot, space, and slash characters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2006-2309

Produtos afetados

Eserv/3

Referências · 10

• http://securityreason.com/securityalert/1006 · Nota
• http://secunia.com/advisories/20059 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-2309 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2309 · Nota
• http://securityfocus.com/bid/18179 · Correção
• http://secunia.com/secunia_research/2006-37/advisory · Aviso do Fabricante
• http://eserv.ru/ru/news/news_detail.php?ID=235 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26741 · Nota
• http://vupen.com/english/advisories/2006/2066 · Nota
• http://securityfocus.com/archive/1/435415/100/0/threaded · Nota