PT-2007-1856 · Postnuke · Postnuke

Publicado 2007-01-19 · Atualizado 2008-11-13 · CVE-2007-0385

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: PostNuke version 0.764

Description: The issue in PostNuke allows remote attackers to obtain sensitive information, specifically the full path, via unvalidated output in the FAQ section, possibly involving an undefined id cat variable in FAQ/index.php.

Recommendations: For PostNuke version 0.764, consider validating the output in the FAQ section to prevent the disclosure of sensitive information, and define the id cat variable to prevent its undefined use.

Correção

Identificadores relacionados

CVE-2007-0385

Produtos afetados

Postnuke

Referências · 6

• http://hackers.ir/advisories/festival.txt · Nota
• http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/FAQ/index.php?root=postnuke&r1=20350&r2=20911 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0385 · Nota de Segurança
• http://noc.postnuke.com/plugins/scmsvn/viewcvs.php/trunk/Historic/PostNuke7x/html/modules/?root=postnuke · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2007-01/0355.html · Nota
• http://osvdb.org/35472 · Nota