Lucene search
HistoryNov 02, 2005 - 11:02 a.m.
CVE-2005-3434
cve-2005-3434
archilles newsworld
information security
access control
sensitive information
remote attackers
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.9 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
82.0%
Archilles Newsworld before 1.5.0-rc1 stores (1) account.nwd and (2) session.nwd under the web root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames, hashed passwords, and session IDs, and gain privileges.
Affected configurations
Node
archillesnewsworldRange≤1.5.0_rc1
ORarchillesnewsworldMatch1.3.1
ORarchillesnewsworldMatch1.3.2
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.9 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
82.0%
Related for CVE-2005-3434