PT-2004-3637 · Netiq · Netiq Webtrends Reporting Center Enterprise Edition

Oliver Karow · Published 2004-12-31 · Updated 2018-10-19 · CVE-2004-2748

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NetIQ WebTrends Reporting Center Enterprise Edition version 6.1a

Description The issue allows remote attackers to determine the installation path of the software. This is achieved by providing an invalid profileid parameter, which results in an error message that leaks the pathname.

Recommendations For version 6.1a, avoid using the profileid parameter in the viewreport.pl script until a fix is available. As a temporary workaround, consider restricting access to the viewreport.pl script to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2004-2748

Affected Products

Netiq Webtrends Reporting Center Enterprise Edition

References · 8

• 🔥 https://exploit-db.com/exploits/23559 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-2748 · Security Note
• http://secunia.com/advisories/10689 · Vendor Advisory
• http://securityfocus.com/bid/9460 · Note
• http://securitytracker.com/id?1008799 · Note
• http://securityreason.com/securityalert/3354 · Note
• http://securityfocus.com/archive/1/350419/30/21610/threaded · Note
• http://osvdb.org/3680 · Note