PT-2010-1939 · Unknown · Employee Timeclock

Published 2010-03-12 · Updated 2018-10-10 · CVE-2010-0123

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Employee Timeclock Software version 0.99

Description The issue concerns the database backup implementation, which stores sensitive information under the web root with insufficient access control. This allows remote attackers to download a database via a direct request for a "semi-predictable file name."

Recommendations For Employee Timeclock Software version 0.99, consider restricting access to the database backup files to minimize the risk of exploitation. As a temporary workaround, limit direct requests for semi-predictable file names until a proper fix is implemented.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0123

Affected Products

Employee Timeclock

References · 6

• http://secunia.com/advisories/38739 · Vendor Advisory
• http://secunia.com/secunia_research/2010-10 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0123 · Security Note
• http://securityfocus.com/archive/1/509990/100/0/threaded · Note
• http://osvdb.org/62833 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56798 · Note