PT-2006-4358 · Php · Phpmaillist

Lostmon · Publicado 2006-07-10 · Atualizado 2008-09-05 · CVE-2006-3483

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPMailList version 1.8.0

Description The issue allows remote attackers to obtain sensitive information, including email addresses of subscribers, configuration information, and the admin username and password, by making direct requests to specific files. This is due to insufficient access control for sensitive information stored under the web document root. The affected files include "list.dat" and "ml config.dat".

Recommendations For PHPMailList version 1.8.0, consider restricting access to the "list.dat" and "ml config.dat" files to prevent unauthorized access until a patch is available. As a temporary workaround, move these files outside of the web document root or apply appropriate access controls to prevent direct requests.

Correção

Identificadores relacionados

CVE-2006-3483

Produtos afetados

Phpmaillist

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-3483 · Nota de Segurança
• http://osvdb.org/27017 · Nota
• http://osvdb.org/27018 · Nota
• http://lostmon.blogspot.com/2006/07/multiple-vulnerabilities-in.html · Nota
• http://securitytracker.com/id?1016439 · Nota