PT-2006-1754 · Imagevue · Imagevue

Published 2006-02-15 · Updated 2017-07-20 · CVE-2006-0700

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions imageVue version 16.1

Description The issue allows remote attackers to obtain folder permission settings by making a direct request to "dir.php", which returns an XML document listing folders and their permissions.

Recommendations For imageVue version 16.1, consider restricting access to the "dir.php" endpoint to prevent unauthorized disclosure of folder permission settings. As a temporary workaround, consider disabling the dir.php endpoint until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-0700

Affected Products

Imagevue

References · 7

• 🔥 http://secunia.com/advisories/18802 · Exploit
• 🔥 http://securityfocus.com/bid/16594 · Exploit
• 🔥 https://exploit-db.com/exploits/27197 · Exploit
• 🔥 http://securityfocus.com/archive/1/424745/30/0/threaded · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-0700 · Security Note
• http://vupen.com/english/advisories/2006/0570 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24641 · Note