Lucene search

[email protected]CVE-2002-1149

HistoryOct 11, 2002 - 4:00 a.m.

CVE-2002-1149

2002-10-1104:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

invision board

phpinfo.php

sensitive information

installation procedure

7.2 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.61 Medium

EPSS

Percentile

97.8%

JSON

The installation procedure for Invision Board suggests that users install the phpinfo.php program under the web root, which leaks sensitive information such as absolute pathnames, OS information, and PHP settings.

CPENameOperatorVersion
invision_power_services:invision_boardinvision power services invision boardeq1.0
invision_power_services:invision_boardinvision power services invision boardeq1.0.1

CPE	Name	Operator	Version
invision_power_services:invision_board	invision power services invision board	eq	1.0
invision_power_services:invision_board	invision power services invision board	eq	1.0.1

References

marc.info/?l=bugtraq&m=103290602609197&w=2

www.iss.net/security_center/static/10178.php

www.osvdb.org/3356

www.securityfocus.com/bid/5789

7.2 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.61 Medium

EPSS

Percentile

97.8%

JSON