PT-2006-2538 · Craig Knudsen · Webcalendar

Cr45H3R + 1 · Published 2006-03-30 · Updated 2018-10-18 · CVE-2006-1537

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Craig Knudsen WebCalendar version 1.1.0-CVS

Description: The issue allows remote attackers to obtain sensitive information via direct requests to various PHP files, which reveal the path in error messages. The affected files include includes/index.php, tests/add duration test.php, tests/all tests.php, groups.php, nonusers.php, includes/settings.php, includes/init.php, includes/settings.php.orig, includes/js/admin.php, includes/js/edit entry.php, includes/js/edit layer.php, includes/js/export import.php, includes/js/popups.php, includes/js/pref.php, and includes/menu/index.php.

Recommendations: For Craig Knudsen WebCalendar version 1.1.0-CVS, consider restricting access to the mentioned PHP files to minimize the risk of exploitation. As a temporary workaround, disable the execution of these files until a patch is available.

Fix

Related Identifiers

CVE-2006-1537

Affected Products

Webcalendar

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2006-1537 · Security Note
• http://osvdb.org/24531 · Note
• http://osvdb.org/24523 · Note
• http://osvdb.org/24527 · Note
• http://osvdb.org/24525 · Note
• http://osvdb.org/24528 · Note
• http://osvdb.org/24530 · Note
• http://osvdb.org/24534 · Note
• http://osvdb.org/24522 · Note
• http://osvdb.org/24526 · Note
• http://securityfocus.com/archive/1/429267/100/0/threaded · Note
• http://osvdb.org/24529 · Note
• http://securityreason.com/securityalert/651 · Note
• http://osvdb.org/24532 · Note
• http://osvdb.org/24535 · Note