PT-2002-1644 · Webtrends · Webtrends Reporting Center

Published 2002-06-11 · Updated 2010-01-16 · CVE-2002-0596

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebTrends Reporting Center version 4.0d

Description The issue allows remote attackers to determine the real path of the web server. This is achieved by sending a GET request to the "get od toc.pl" endpoint with an empty Profile parameter, which results in an error message that leaks the pathname.

Recommendations For WebTrends Reporting Center version 4.0d, consider restricting access to the "get od toc.pl" endpoint until a patch is available. As a temporary workaround, avoid using the Profile parameter in the affected endpoint to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2002-0596

Affected Products

Webtrends Reporting Center

References · 5

• http://archives.neohapsis.com/archives/bugtraq/2002-04/0207.html · Vendor Advisory
• http://iss.net/security_center/static/8865.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0596 · Security Note
• http://osvdb.org/10447 · Note
• http://ngssoftware.com/advisories/wtr.txt · Note