PT-2004-2886 · Aldo · Aldo'S Web Server

Published 2004-03-03 · Updated 2017-07-11 · CVE-2004-1990

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aldo's Web Server (aweb) version 1.5

Description The issue allows remote attackers to gain sensitive information via an arbitrary character, which reveals the full path and the user running the aweb process, possibly due to a malformed request.

Recommendations For version 1.5, consider restricting access to sensitive information until a patch is available. As a temporary workaround, review and sanitize all input to prevent malformed requests from being processed.

Exploit

Fix

Related Identifiers

CVE-2004-1990

Affected Products

Aldo'S Web Server

References · 7

• 🔥 http://secunia.com/advisories/11542 · Exploit
• 🔥 http://securityfocus.com/bid/10262 · Exploit
• 🔥 http://oliverkarow.de/research/AldosWebserverMultipleVulns.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1990 · Security Note
• http://osvdb.org/5880 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16047 · Note
• http://marc.info/?l=bugtraq&m=108360629031227&w=2 · Note