PT-2005-4753 · Unknown · Widget Property

Published 2005-12-05 · Updated 2008-09-20 · CVE-2005-4017

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Widget Property version 1.1.19

Description The issue allows remote attackers to obtain the full server path via an invalid lang value. This is achieved by exploiting the property.php file, which leaks the path in the resulting error message.

Recommendations For version 1.1.19, consider validating and sanitizing the lang value to prevent path disclosure. As a temporary workaround, restrict access to the property.php file until a patch is available.

Fix

Related Identifiers

CVE-2005-4017

Affected Products

Widget Property

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2005-4017 · Security Note
• http://secunia.com/advisories/17829 · Note
• http://pridels0.blogspot.com/2005/12/widget-property-vuln.html · Note
• http://osvdb.org/21427 · Note