PT-2005-3802 · Atutor · Atutor

Retrogod · Published 2005-09-16 · Updated 2016-10-18 · CVE-2005-2956

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ATutor versions 1.5.1 and earlier

Description The issue allows remote attackers to obtain user chat conversations due to insufficient access control and predictable filenames of temporary chat logs stored under the web document root.

Recommendations For ATutor versions 1.5.1 and earlier, consider restricting access to the temporary chat log files until a proper fix is applied, and review the access control settings to prevent direct requests to those files.

Exploit

Fix

Related Identifiers

CVE-2005-2956

Affected Products

Atutor

References · 7

• 🔥 https://exploit-db.com/exploits/26258 · Exploit
• 🔥 http://securityfocus.com/bid/14832 · Exploit
• 🔥 http://rgod.altervista.org/atutor151.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-2956 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2956 · Note
• http://marc.info/?l=bugtraq&m=112671176100432&w=2 · Note
• http://securityreason.com/securityalert/9 · Note