PT-2007-2979 · Unclassified · Unclassified Newsboard

Published 2007-03-22 · Updated 2018-10-16 · CVE-2007-1597

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Unclassified NewsBoard version 1.6.3

Description The issue allows remote attackers to obtain sensitive information due to insufficient access control. This includes accessing the board log, mail and private message log, SQL error message log, and IP log via direct requests for specific log files, such as "logs/board-YYYY-MM-DD.log", "logs/email-YY-MM-DD-HH-MM-SS.log", "logs/error-YY-MM.log", and "logs/ip.log".

Recommendations For Unclassified NewsBoard version 1.6.3, consider restricting access to the logs directory to prevent remote attackers from obtaining sensitive information. As a temporary workaround, restrict access to the vulnerable log files until a patch is available.

Fix

Related Identifiers

CVE-2007-1597

Affected Products

Unclassified Newsboard

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-1597 · Security Note
• http://securityfocus.com/archive/1/463186/100/0/threaded · Note
• http://osvdb.org/35201 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33150 · Note