PT-2007-6224 · Simpgb · Simpgb

Jesper Jurcenoks · Publicado 2007-09-27 · Atualizado 2018-10-15 · CVE-2007-5129

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SimpGB version 1.46.02

Description The issue allows remote attackers to obtain sensitive configuration information and download arbitrary files due to insufficient access control. This can be achieved by making a direct request for specific files, such as admin/cfginfo.php for configuration information, and other .inc files, for example, admin/includes/dbtables.inc.

Recommendations For SimpGB version 1.46.02, consider restricting direct access to sensitive files such as admin/cfginfo.php and .inc files under the admin/includes directory until a proper fix is available. As a temporary workaround, restrict access to the admin directory to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2007-5129

Produtos afetados

Simpgb

Referências · 11

• http://osvdb.org/40613 · Nota
• http://forum.boesch-it.de/viewtopic.php?t=2790 · Correção
• http://secunia.com/advisories/26974 · Aviso do Fabricante
• http://securityfocus.com/archive/1/480590/100/0/threaded · Nota
• http://osvdb.org/40612 · Nota
• http://netvigilance.com/advisory0065 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5129 · Nota de Segurança
• http://securityfocus.com/archive/1/480592/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36777 · Nota
• http://netvigilance.com/advisory0066 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36776 · Nota