PT-2004-1509 · Invision · Invision Power Board

Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0355

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board version 1.3 Final

Description The issue allows remote attackers to gain sensitive information. This is achieved by selecting a non-image file for the "Personal Photo" option, which then displays the installation path in an error message.

Recommendations For Invision Power Board version 1.3 Final, consider validating the file type for the "Personal Photo" option to prevent non-image files from being selected, thus avoiding the disclosure of sensitive installation path information.

Fix

Related Identifiers

CVE-2004-0355

Affected Products

Invision Power Board

References · 5

• http://securityfocus.com/bid/9810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0355 · Security Note
• http://marc.info/?l=bugtraq&m=107850510428567&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15400 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0355 · Note