Lucene search

MitreCVE-2006-6866

HistoryJan 04, 2007 - 10:00 p.m.

CVE-2006-6866

2007-01-0422:00:00

mitre

web.nvd.nist.gov

stphp easynews pro 4.0

sensitive information

access control

remote attackers

usernames

email addresses

password hashes

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.034

Percentile

91.4%

JSON

STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, email addresses, and password hashes via a direct request for data/users.txt.

Affected configurations

Nvd

Node

stphpeasynewsMatch4.0pro

VendorProductVersionCPE
stphpeasynews4.0cpe:2.3:a:stphp:easynews:4.0:*:pro:*:*:*:*:*

Vendor	Product	Version	CPE
stphp	easynews	4.0	cpe:2.3:a:stphp:easynews:4.0::pro:::::

References

secunia.com/advisories/23577

securitytracker.com/id?1017457

www.vupen.com/english/advisories/2007/0011

exchange.xforce.ibmcloud.com/vulnerabilities/31171

www.exploit-db.com/exploits/3039

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

AI Score

6.8

Confidence

Low

EPSS

0.034

Percentile

91.4%

JSON

Related for CVE-2006-6866