PT-2005-5028 · Blackboard · Blackboard Learning/Community Portal System

Published 2005-12-17 · Updated 2008-09-05 · CVE-2005-4341

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Blackboard Learning and Community Portal System versions prior to 6.3.1.424

Description The issue allows remote attackers to list all available categories by providing a blank category id parameter to the "category.pl" endpoint. It is unclear whether the exposed information is sensitive.

Recommendations For versions prior to 6.3.1.424, as a temporary workaround, consider restricting access to the "category.pl" endpoint until a fix is available. Avoid using a blank category id parameter in the affected endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4341

Affected Products

Blackboard Learning/Community Portal System

References · 4

• http://ipomonis.com/advisories/Bb_6.zip · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-4341 · Security Note
• http://osvdb.org/21619 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4341 · Note