PT-2007-1638 · Ajlogin · Ajlogin

Publicado 2007-01-09 · Atualizado 2018-10-16 · CVE-2007-0153

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AJLogin version 3.5

Description The issue allows remote attackers to download a database containing passwords via a direct request for ajlogin.mdb due to insufficient access control. This is because sensitive information is stored under the web root.

Recommendations For AJLogin version 3.5, consider restricting access to the ajlogin.mdb file to minimize the risk of exploitation. As a temporary workaround, limit direct requests to this file until a more secure storage solution is implemented.

Correção

Identificadores relacionados

CVE-2007-0153

Produtos afetados

Ajlogin

Referências · 5

• http://osvdb.org/33404 · Nota
• http://securityreason.com/securityalert/2127 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0153 · Nota de Segurança
• http://securityfocus.com/archive/1/456226/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31331 · Nota