PT-2007-1678 · Mkportal · Mkportal

Published 2007-01-11 · Updated 2018-10-16 · CVE-2007-0194

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MKPortal version M1.1 RC1

Description The issue allows remote attackers to obtain sensitive information via a direct request to the 'admin.php' endpoint with an MK PATH query string set to 1, which reveals the path in an error message.

Recommendations For MKPortal version M1.1 RC1, consider restricting access to the 'admin.php' endpoint until a fix is available, or avoid using the MK PATH query string with a value of 1 to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0194

Affected Products

Mkportal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-0194 · Security Note
• http://securityfocus.com/archive/1/456257/100/0/threaded · Note
• http://osvdb.org/33407 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31333 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0194 · Note