PT-2005-3490 · Fudforum · Fudforum

Alexander Heidenreich · Published 2005-08-17 · Updated 2008-09-05 · CVE-2005-2600

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions FUDForum version 2.6.15

Description The issue allows remote attackers to read private posts. This is achieved by modifying the mid parameter. The problem is specifically noted in configurations where the "Tree View" is enabled, a setup also found in other products.

Recommendations For FUDForum version 2.6.15, consider disabling the "Tree View" feature as a temporary workaround until a patch is available. Restrict access to private posts to minimize the risk of exploitation. Avoid using the modified mid parameter in affected configurations until the issue is resolved.

Fix

Related Identifiers

CVE-2005-2600

DSA-798-1

DSA-899-1

Affected Products

Fudforum

References · 7

• http://secunia.com/advisories/16414 · Vendor Advisory
• http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html · Patch
• http://debian.org/security/2005/dsa-798 · Vendor Advisory
• http://debian.org/security/2005/dsa-899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2600 · Security Note
• http://securityfocus.com/bid/14556 · Note
• http://secunia.com/advisories/17643 · Note