PT-2002-1352 · Dcp · Dcp-Portal

Published 2002-05-03 · Updated 2017-07-11 · CVE-2002-0282

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions DCP-Portal versions 3.7 through 4.5

Description The issue allows remote attackers to obtain the physical path of the server. This can be achieved through a direct request to "add user.php" or by providing an invalid new language parameter in "contents.php", "categories.php", or "files.php", which results in the path being leaked in an error message.

Recommendations For versions 3.7 through 4.5, consider restricting access to the affected PHP files until a patch is available. As a temporary workaround, avoid using the new language parameter in the affected API endpoints.

Fix

Related Identifiers

CVE-2002-0282

Affected Products

Dcp-Portal

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2002-0282 · Security Note
• http://iss.net/security_center/static/8310.php · Vendor Advisory
• http://marc.info/?l=bugtraq&m=101494497608620&w=2 · Note
• http://dcp-portal.com/files.php?action=viewcat&fcat_id=1 · Note
• http://securityfocus.com/bid/4113 · Note
• http://marc.info/?l=bugtraq&m=101379160830631&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8196 · Note