PT-2005-5303 · Kayako · Kayako Supportsuite

Published 2005-12-31 · Updated 2017-07-20 · CVE-2005-4638

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kayako SupportSuite versions 3.00.26 and earlier

Description The issue allows remote attackers to obtain the full path via specific parameters in different modules. This is possible through the a and newsid parameters in the news module, the downloaditemid parameter in the downloads module, and the kbarticleid parameter in the knowledgebase module.

Recommendations For Kayako SupportSuite versions 3.00.26 and earlier, update to a version later than 3.00.26 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2005-4638

Affected Products

Kayako Supportsuite

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-4638 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4638 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23917 · Note
• http://osvdb.org/22226 · Note
• http://pridels0.blogspot.com/2005/12/kayako-supportsuite-multiple-vuln.html · Note