PT-2006-4782 · Alkacon · Opencms
Meder Kydyraliev
·
Publicado
2006-07-31
·
Atualizado
2022-05-01
·
CVE-2006-3936
CVSS v2.0
4.0
Média
| Vetor | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Alkacon OpenCms versions prior to 6.2.2
Description
The issue allows remote authenticated users to read the source code of arbitrary JSP files by specifying the file in the
resource parameter. This can be demonstrated using the index.jsp file in the system/workplace/editors/editor.jsp endpoint.Recommendations
For versions prior to 6.2.2, update to version 6.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the
system/workplace/editors/editor.jsp endpoint to minimize the risk of exploitation. Avoid using the resource parameter in this endpoint until the issue is resolved.Exploit
Correção
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Opencms