PT-2007-6720 · Efileman · Efileman

Published 2007-10-30 · Updated 2018-10-15 · CVE-2007-5735

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions eFileMan versions 7.1.0.87 through 7.1.0.88

Description The issue allows remote attackers to obtain unspecified user information due to insufficient access control of sensitive information stored under the web root. This can be achieved via a direct request for the "cgi-bin/efileman/efileman config.pm" endpoint.

Recommendations For versions 7.1.0.87 through 7.1.0.88, consider restricting access to the efileman config.pm file to minimize the risk of exploitation. As a temporary workaround, limit direct requests to the "cgi-bin/efileman/efileman config.pm" endpoint until a more permanent solution is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-5735

Affected Products

Efileman

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5735 · Security Note
• http://securityfocus.com/bid/26184 · Note
• http://securityreason.com/securityalert/3323 · Note
• http://osvdb.org/39012 · Note
• http://securityfocus.com/archive/1/482683/100/0/threaded · Note