PT-2006-1760 · Pyblosxom · Pyblosxom

Published 2006-02-15 · Updated 2017-07-20 · CVE-2006-0707

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PyBlosxom versions prior to 1.3.2

Description The issue allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH INFO variable. This occurs when PyBlosxom is running on certain webservers.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the PATH INFO variable to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2006-0707

Affected Products

Pyblosxom

References · 7

• http://sourceforge.net/project/shownotes.php?release_id=391800 · Patch
• https://osv.dev/vulnerability/CVE-2006-0707 · Vendor Advisory
• http://secunia.com/advisories/18858 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0707 · Security Note
• http://vupen.com/english/advisories/2006/0571 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24730 · Note
• http://securityfocus.com/bid/16641 · Note