PT-2002-2754 · Faqmanager · Faqmanager

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2033

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FAQManager versions 2.2.5 and earlier

Description The issue allows remote attackers to read arbitrary files by specifying the filename in the toc parameter with a trailing null character (%00).

Recommendations For FAQManager versions 2.2.5 and earlier, consider restricting access to the faqmanager.cgi script until a patch is available. As a temporary workaround, avoid using the toc parameter with a trailing null character (%00) to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-2033

Affected Products

Faqmanager

References · 4

• http://iss.net/security_center/static/7833.php · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2002-2033 · Security Note
• http://securityfocus.com/bid/3810 · Patch
• http://archives.neohapsis.com/archives/bugtraq/2002-01/0065.html · Patch