PT-2002-2401 · Unknown · Mrtgconfig

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1677

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions mrtgconfig versions 1.1p15

Description The issue allows remote attackers to determine the physical path to the web root directory. This is achieved by sending a request with an invalid cfg parameter to the 14all.cgi script, which generates an error message that reveals the path.

Recommendations For version 1.1p15, consider restricting access to the 14all.cgi script until a patch is available. As a temporary workaround, avoid using the cfg parameter in the affected script to minimize the risk of path disclosure.

Exploit

Fix

Related Identifiers

CVE-2002-1677

Affected Products

Mrtgconfig

References · 6

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2002-01/0421.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1677 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1677 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8070 · Note
• http://securityfocus.com/bid/4021 · Note
• http://online.securityfocus.com/archive/1/254278 · Note