PT-2006-1441 · Rcblog · Rcblog

Aliaksandr Hartsuyeu · Published 2006-01-22 · Updated 2024-02-14 · CVE-2006-0370

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions RCBlog version 1.03

Description The issue allows remote attackers to view account names and MD5 password hashes due to insufficient access control of the data and config directories stored under the web root.

Recommendations For RCBlog version 1.03, consider restricting access to the data and config directories to prevent remote viewing of sensitive information. As a temporary workaround, restrict access to these directories until a proper fix is applied.

Exploit

Fix

Related Identifiers

CVE-2006-0370

Affected Products

Rcblog

References · 8

• 🔥 http://evuln.com/vulns/42/summary.html · Exploit
• http://secunia.com/advisories/18547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0370 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24249 · Note
• http://osvdb.org/22679 · Note
• http://securitytracker.com/id?1015523 · Note
• http://fluffington.com/index.php?page=rcblog · Note
• http://securityfocus.com/archive/1/422499/100/0/threaded · Note