PT-2004-1809 · Phpbb · Phpbb

Janek Vind + 1 · Published 2004-07-23 · Updated 2017-07-11 · CVE-2004-0729

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpBB version 2.0.8

Description The issue allows remote attackers to gain sensitive information. This is achieved by providing an invalid parameter to certain API endpoints, which then reveal the full path in an error message. Specifically, this can be done through the category rows parameter to "index.php", the faq parameter to "faq.php", or the ranksrow parameter to "profile.php".

Recommendations For phpBB version 2.0.8, consider restricting access to the vulnerable API endpoints "index.php", "faq.php", and "profile.php" until a fix is available. As a temporary workaround, avoid using the category rows, faq, and ranksrow parameters in these endpoints to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-0729

Affected Products

Phpbb

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2004-0729 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16720 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0729 · Note
• http://waraxe.us/index.php?modname=sa&id=34 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16716 · Note
• http://marc.info/?l=bugtraq&m=108999024506020&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16723 · Note