PT-2007-6225 · Simpgb · Simpgb

Publicado 2007-09-27 · Atualizado 2018-10-15 · CVE-2007-5130

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SimpGB version 1.46.02

Description The issue allows remote attackers to obtain sensitive information. This can be achieved via an invalid lang parameter to the "admin/index.php" API endpoint or a direct request to the "admin/trailer.php" endpoint, which reveals the path in various error messages.

Recommendations For SimpGB version 1.46.02, avoid using the lang parameter in the "admin/index.php" API endpoint until the issue is resolved. Restrict access to the "admin/trailer.php" endpoint to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-5130

Produtos afetados

Simpgb

Referências · 6

• http://securityreason.com/securityalert/3172 · Nota
• http://securityfocus.com/archive/1/480593/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5130 · Nota de Segurança
• http://netvigilance.com/advisory0064 · Nota
• http://forum.boesch-it.de/viewtopic.php?t=2790 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36775 · Nota