PT-2005-4230 · Archilles · Archilles Newsworld

Chb + 1 · Published 2005-11-02 · Updated 2017-07-11 · CVE-2005-3434

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Archilles Newsworld versions prior to 1.5.0-rc1

Description The issue allows remote attackers to obtain sensitive information, including usernames, hashed passwords, and session IDs, and potentially gain privileges due to insufficient access control of certain files stored under the web root.

Recommendations For versions prior to 1.5.0-rc1, update to version 1.5.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting access to the account.nwd and session.nwd files to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-3434

Affected Products

Archilles Newsworld

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-3434 · Security Note
• http://secunia.com/advisories/17310 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22859 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/22860 · Note
• http://marc.info/?l=bugtraq&m=113018731120709&w=2 · Note