PT-2007-6744 · Blue Collar Productions · I-Gallery

Publicado 2007-11-01 · Atualizado 2018-10-15 · CVE-2007-5777

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Blue-Collar Productions i-Gallery version 3.4

Description The issue allows remote attackers to download a file containing a base64-encoded password via a direct request for "igallery.mdb". This is due to insufficient access control, as sensitive information is stored under the web root.

Recommendations For version 3.4, consider restricting access to the "igallery.mdb" file to prevent unauthorized downloads, and review the access control settings for sensitive information stored under the web root.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-5777

Produtos afetados

I-Gallery

Referências · 5

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5777 · Nota
• http://osvdb.org/43629 · Nota
• http://securityreason.com/securityalert/3330 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5777 · Nota de Segurança
• http://securityfocus.com/archive/1/482788/100/0/threaded · Nota