Lucene search

[email protected]CVE-2005-4148

HistoryDec 10, 2005 - 11:03 a.m.

CVE-2005-4148

2005-12-1011:03:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

lyris listmanager

sensitive information

disclosure

cve-2005-4148

nvd

6.5 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.011 Low

EPSS

Percentile

84.3%

JSON

Lyris ListManager 8.5, and possibly other versions before 8.8, includes sensitive information in the env hidden variable, which allows remote attackers to obtain information such as the installation path by requesting a non-existent page and reading the env variable from the resulting error message page.

CPENameOperatorVersion
lyris_technologies_inc:listmanagerlyris technologies inc listmanagereq5.0
lyris_technologies_inc:listmanagerlyris technologies inc listmanagereq8.0
lyris_technologies_inc:listmanagerlyris technologies inc listmanagereq8.8a
lyris_technologies_inc:listmanagerlyris technologies inc listmanagereq6.0
lyris_technologies_inc:listmanagerlyris technologies inc listmanagereq7.0

CPE	Name	Operator	Version
lyris_technologies_inc:listmanager	lyris technologies inc listmanager	eq	5.0
lyris_technologies_inc:listmanager	lyris technologies inc listmanager	eq	8.0
lyris_technologies_inc:listmanager	lyris technologies inc listmanager	eq	8.8a
lyris_technologies_inc:listmanager	lyris technologies inc listmanager	eq	6.0
lyris_technologies_inc:listmanager	lyris technologies inc listmanager	eq	7.0

References

archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html

metasploit.com/research/vulns/lyris_listmanager/

secunia.com/advisories/17943

www.osvdb.org/21552

www.securityfocus.com/archive/1/419077/100/0/threaded

www.securityfocus.com/bid/15789

www.vupen.com/english/advisories/2005/2820

6.5 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.011 Low

EPSS

Percentile

84.3%

JSON

Related for CVE-2005-4148

nessus2