PT-2006-4358 · Php · Phpmaillist

Lostmon · Published 2006-07-10 · Updated 2008-09-05 · CVE-2006-3483

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions PHPMailList version 1.8.0

Description The issue allows remote attackers to obtain sensitive information, including email addresses of subscribers, configuration information, and the admin username and password, by making direct requests to specific files. This is due to insufficient access control for sensitive information stored under the web document root. The affected files include "list.dat" and "ml config.dat".

Recommendations For PHPMailList version 1.8.0, consider restricting access to the "list.dat" and "ml config.dat" files to prevent unauthorized access until a patch is available. As a temporary workaround, move these files outside of the web document root or apply appropriate access controls to prevent direct requests.

Fix

Related Identifiers

CVE-2006-3483

Affected Products

Phpmaillist

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-3483 · Security Note
• http://osvdb.org/27017 · Note
• http://osvdb.org/27018 · Note
• http://lostmon.blogspot.com/2006/07/multiple-vulnerabilities-in.html · Note
• http://securitytracker.com/id?1016439 · Note