PT-2004-3398 · Wikindx · Wikindx

Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2506

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions WIKINDX versions prior to 0.9.9g

Description The issue allows remote attackers to obtain sensitive information via a direct HTTP request to the config.inc file. This is due to an unparsed web content delivery vulnerability.

Recommendations For versions prior to 0.9.9g, update to version 0.9.9g or later to resolve the issue. As a temporary workaround, consider restricting access to the config.inc file to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-2506

Affected Products

Wikindx

References · 5

• http://secunia.com/advisories/11394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2506 · Security Note
• http://sourceforge.net/project/shownotes.php?release_id=231421 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15885 · Note
• http://osvdb.org/5401 · Note