PT-2004-2871 · Pafiledb · Pafiledb

Darkbicho · Published 2004-04-27 · Updated 2017-07-11 · CVE-2004-1974

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions paFileDB version 3.1

Description The issue allows remote attackers to gain sensitive information via a direct request to various API endpoints, including "login.php", "category.php", "search.php", "main.php", "viewall.php", "download.php", "email.php", "file.php", "rate.php", or "stats.php". These endpoints reveal the path in an error message, potentially exposing sensitive information.

Recommendations For paFileDB version 3.1, consider restricting access to the mentioned API endpoints until a patch is available. As a temporary workaround, disable the display of error messages that reveal sensitive path information.

Fix

Related Identifiers

CVE-2004-1974

Affected Products

Pafiledb

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2004-1974 · Security Note
• http://marc.info/?l=bugtraq&m=108311096022485&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15990 · Note