PT-2007-2979 · Unclassified · Unclassified Newsboard

Publicado 2007-03-22 · Atualizado 2018-10-16 · CVE-2007-1597

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Unclassified NewsBoard version 1.6.3

Description The issue allows remote attackers to obtain sensitive information due to insufficient access control. This includes accessing the board log, mail and private message log, SQL error message log, and IP log via direct requests for specific log files, such as "logs/board-YYYY-MM-DD.log", "logs/email-YY-MM-DD-HH-MM-SS.log", "logs/error-YY-MM.log", and "logs/ip.log".

Recommendations For Unclassified NewsBoard version 1.6.3, consider restricting access to the logs directory to prevent remote attackers from obtaining sensitive information. As a temporary workaround, restrict access to the vulnerable log files until a patch is available.

Correção

Identificadores relacionados

CVE-2007-1597

Produtos afetados

Unclassified Newsboard

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-1597 · Nota de Segurança
• http://securityfocus.com/archive/1/463186/100/0/threaded · Nota
• http://osvdb.org/35201 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33150 · Nota