CVE-2005-1635
CVSS5.0
发布时间 :2005-05-17 00:00:00
修订时间 :2016-10-17 23:21:28
NMCO    

[原文]JGS-XA JGS-Portal 3.0.2 and earlier allows remote attackers to obtain the full server path via direct requests to (1) jgs_portal_ref.php, (2) jgs_portal_land.php, (3) jgs_portal_log.php, (4) jgs_portal_global_sponsor.php, (5) jgs_portal_global.php, (6) jgs_portal_system.php, (7) jgs_portal_views.php; or multiple files in the jgs_portal_include directory, including (8) jgs_portal_boardmenue.php, (9) jgs_portal_forenliste.php, (10) jgs_portal_geburtstag.php, (11) jgs_portal_guckloch.php, (12) jgs_portal_kalender.php, (13) jgs_portal_letztethemen.php, (14) jgs_portal_links.php, (15) jgs_portal_neustemember.php, (16) jgs_portal_newsboard.php, (17) jgs_portal_online.php, (18) jgs_portal_pn.php, (19) jgs_portal_portalmenue.php, (20) jgs_portal_styles.php, (21) jgs_portal_suchen.php, (22) jgs_portal_team.php, (23) jgs_portal_topforen.php, (24) jgs_portal_topposter.php, (25) jgs_portal_umfrage.php, (26) jgs_portal_useravatar.php, (27) jgs_portal_waronline.php, (28) jgs_portal_woonline.php, or (29) jgs_portal_zufallsavatar.php.


[CNNVD]JGS-XA JGS-Portal漏洞(CNNVD-200505-1075)

        JGS-XA JGS-Portal 3.0.2及更早版本允许远程攻击者通过直接请求(1)jgs_portal_ref.php,(2)jgs_portal_land.php,(3)jgs_portal_log.php,(4)jgs_portal_global_sponsor.php,(5)jgs_portal_global.php,(6)jgs_portal_system.php,(7)jgs_portal_views.php;或在jgs_portal_include目录中的多个文件,包括(8)jgs_portal_boardmenue.php,(9)jgs_portal_forenliste.php,(10)jgs_portal_geburtstag.php,(11)jgs_portal_guckloch.php,(12)jgs_portal_kalender.php,(13)jgs_portal_letztethemen.php,(14)jgs_portal_links.php,(15)jgs_portal_neustemember.php,(16)jgs_portal_newsboard.php,(17)jgs_portal_online.php,(18)jgs_portal_pn.php,(19)jgs_portal_portalmenue.php, (20)jgs_portal_styles.php,(21) jgs_portal_suchen.php,(22)jgs_portal_team.php, (23)jgs_portal_topforen.php,(24) jgs_portal_topposter.php,(25) jgs_portal_umfrage.php,(26) jgs_portal_useravatar.php,(27)jgs_portal_waronline.php,(28)jgs_portal_woonline.php或(29)jgs_portal_zufallsavatar.php,来获取服务器的完整路径。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: [--]
完整性影响: [--]
可用性影响: [--]
攻击复杂度: [--]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1635
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1635
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200505-1075
(官方数据源) CNNVD

- 其它链接及资源

http://marc.info/?l=bugtraq&m=111627681218415&w=2
(UNKNOWN)  BUGTRAQ  20050516 [SePro Bugtraq] WBB Portal - JGS-Portal <= 3.0.2 - Multiple Vulnerabilities (09.05.05)

- 漏洞信息

JGS-XA JGS-Portal漏洞
中危 未知
2005-05-17 00:00:00 2006-06-15 00:00:00
远程  
        JGS-XA JGS-Portal 3.0.2及更早版本允许远程攻击者通过直接请求(1)jgs_portal_ref.php,(2)jgs_portal_land.php,(3)jgs_portal_log.php,(4)jgs_portal_global_sponsor.php,(5)jgs_portal_global.php,(6)jgs_portal_system.php,(7)jgs_portal_views.php;或在jgs_portal_include目录中的多个文件,包括(8)jgs_portal_boardmenue.php,(9)jgs_portal_forenliste.php,(10)jgs_portal_geburtstag.php,(11)jgs_portal_guckloch.php,(12)jgs_portal_kalender.php,(13)jgs_portal_letztethemen.php,(14)jgs_portal_links.php,(15)jgs_portal_neustemember.php,(16)jgs_portal_newsboard.php,(17)jgs_portal_online.php,(18)jgs_portal_pn.php,(19)jgs_portal_portalmenue.php, (20)jgs_portal_styles.php,(21) jgs_portal_suchen.php,(22)jgs_portal_team.php, (23)jgs_portal_topforen.php,(24) jgs_portal_topposter.php,(25) jgs_portal_umfrage.php,(26) jgs_portal_useravatar.php,(27)jgs_portal_waronline.php,(28)jgs_portal_woonline.php或(29)jgs_portal_zufallsavatar.php,来获取服务器的完整路径。

- 公告与补丁

        暂无数据

- 漏洞信息

16664
JGS-Portal for WoltLab Burning Board Error Routine Path Disclosure
Remote / Network Access Information Disclosure
Loss of Confidentiality
Exploit Public

- 漏洞描述

JGS-Portal for Woltlab Burning Board contains a flaw that may lead to an unauthorized information disclosure.  The issue is triggered when an attacker makes a direct request to a script and provides no arguments, which will disclose the installation path of the application resulting in a loss of confidentiality.

- 时间线

2005-05-16 Unknow
2005-05-16 Unknow

- 解决方案

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站