PT-2007-1017 · Debian · Sitebar
Stephane Bonnell
·
Publicado
2007-10-17
·
Atualizado
2011-03-08
·
CVE-2007-5491
CVSS v2.0
9.0
Alta
| Vetor | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
SiteBar version 3.3.8
Description:
The issue concerns multiple vulnerabilities in the SiteBar package of the Debian GNU/Linux operating system, which can be exploited by a remote attacker who has passed the authentication procedure. This can lead to a breach of confidentiality, integrity, and availability of protected information. Specifically, a directory traversal vulnerability exists in the translation module, allowing remote authenticated users to modify permissions of arbitrary files via the
lang parameter in translator.php by using ".." sequences.Recommendations:
For SiteBar version 3.3.8, consider restricting access to the
translator.php file until a patch is available, and avoid using the lang parameter in the translation module to minimize the risk of exploitation.Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sitebar