PT-2007-2715 · Douran Software Technologies · Isputil

Published 2007-03-07 · Updated 2017-07-29 · CVE-2007-1300

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions DOURAN Software Technologies ISPUtil version 3.32.84.1 and possibly earlier versions

Description The issue allows remote attackers to obtain user and reseller data due to insufficient access control of sensitive information stored under the web root. This can be achieved via a direct request for the scripts/activesessions.ini file.

Recommendations For version 3.32.84.1 and possibly earlier versions, restrict access to the scripts/activesessions.ini file to minimize the risk of exploitation. Consider implementing proper access controls for sensitive information stored under the web root. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1300

Affected Products

Isputil

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-1300 · Security Note
• http://secunia.com/advisories/24304 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32800 · Note
• http://osvdb.org/33845 · Note