PT-2006-3312 · Sap · E-Business Designer

Publicado 2006-05-12 · Atualizado 2018-10-18 · CVE-2006-2347

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions E-Business Designer (eBD) versions 3.1.4 and earlier

Description The issue allows remote attackers to obtain the full path of the web server by using specific characters, such as '', and possibly other invalid values, in the id parameter to "form grupo.html", or by making requests to the "archivos/" and "files/" directories. This might be related to SQL injection.

Recommendations For E-Business Designer (eBD) versions 3.1.4 and earlier, consider restricting access to the "archivos/" and "files/" directories and validating the id parameter in "form grupo.html" to prevent exploitation until a fix is available. Avoid using invalid values in the id parameter to minimize the risk of path disclosure.

Correção

Identificadores relacionados

CVE-2006-2347

Produtos afetados

E-Business Designer

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26476 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/045980.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-2347 · Nota de Segurança
• http://securityreason.com/securityalert/891 · Nota
• http://secunia.com/advisories/20071 · Aviso do Fabricante
• http://vupen.com/english/advisories/2006/1784 · Nota
• http://securityfocus.com/archive/1/433807/100/0/threaded · Nota
• http://securityfocus.com/bid/17933 · Nota