PT-2007-6720 · Efileman · Efileman

Publicado 2007-10-30 · Atualizado 2018-10-15 · CVE-2007-5735

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions eFileMan versions 7.1.0.87 through 7.1.0.88

Description The issue allows remote attackers to obtain unspecified user information due to insufficient access control of sensitive information stored under the web root. This can be achieved via a direct request for the "cgi-bin/efileman/efileman config.pm" endpoint.

Recommendations For versions 7.1.0.87 through 7.1.0.88, consider restricting access to the efileman config.pm file to minimize the risk of exploitation. As a temporary workaround, limit direct requests to the "cgi-bin/efileman/efileman config.pm" endpoint until a more permanent solution is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-5735

Produtos afetados

Efileman

Referências · 5

• http://securityfocus.com/bid/26184 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5735 · Nota de Segurança
• http://securityreason.com/securityalert/3323 · Nota
• http://osvdb.org/39012 · Nota
• http://securityfocus.com/archive/1/482683/100/0/threaded · Nota