PT-2008-5469 · Oscommerce · Oscommerce

John Cobb · Publicado 2008-09-22 · Atualizado 2018-10-11 · CVE-2008-4170

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions osCommerce version 2.2 RC 2a

Description The issue allows remote attackers to obtain sensitive information via an invalid dob parameter in the create account.php file. This reveals the installation path in an error message.

Recommendations For osCommerce version 2.2 RC 2a, consider modifying the create account.php file to handle invalid dob parameters without revealing sensitive information, such as the installation path, in error messages. As a temporary workaround, restrict access to the create account.php file to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-4170

Produtos afetados

Oscommerce

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-4170 · Nota de Segurança
• http://securityfocus.com/bid/31209 · Nota
• http://securityfocus.com/archive/1/496417/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45193 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4170 · Nota
• http://securityreason.com/securityalert/4293 · Nota