PT-2004-3561 · Endonesia · Endonesia

Published 2004-12-31 · Updated 2017-07-29 · CVE-2004-2671

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions eNdonesia version 8.3

Description The issue allows remote attackers to obtain sensitive information via certain direct requests and requests with invalid parameter values, which reveal the path in various error messages. This is demonstrated by the mod and cid parameters.

Recommendations For eNdonesia version 8.3, consider restricting access to the mod.php file to minimize the risk of exploitation. As a temporary workaround, avoid using the mod and cid parameters in requests to the mod.php file until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2004-2671

Affected Products

Endonesia

References · 7

• 🔥 http://securityfocus.com/archive/1/370855 · Exploit
• 🔥 http://echo.or.id/adv/adv02-y3dips-2004.txt · Exploit
• 🔥 http://securityfocus.com/bid/8507 · Exploit
• http://securitytracker.com/id?1010864 · Vendor Advisory
• http://secunia.com/advisories/12231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-2671 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/13042 · Note