PT-2004-2167 · Pafiledb · Pafiledb

Published 2004-12-15 · Updated 2017-07-11 · CVE-2004-1219

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: paFileDB version 3.1

Description: The issue allows remote attackers to read the administrator's password hash and conduct brute force password guessing attacks by listing the contents of the sessions directory and reading the associated file for the administrator session, when sessions authentication is used and the administrator logs on.

Recommendations: For paFileDB version 3.1, consider restricting access to the sessions directory to prevent unauthorized reading of the administrator's session file as a temporary workaround.

Fix

Related Identifiers

CVE-2004-1219

Affected Products

Pafiledb

References · 5

• http://securityfocus.com/bid/11818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1219 · Security Note
• http://marc.info/?l=bugtraq&m=110245123927025&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18364 · Note
• http://echo.or.id/adv/adv09-y3dips-2004.txt · Note