|
Family: CGI abuses --> Category: infos
BasiliX Attachment Disclosure Vulnerability Vulnerability Scan
Vulnerability Scan Summary Checks for attachment disclosure vulnerability in BasiliX
Detailed Explanation for this Vulnerability Test
Synopsis :
The remote web server contains a series of PHP scripts that are prone to
information disclosure.
Description :
The remote host appears to be running a BasiliX version 1.1.0 or lower.
Such versions save attachments by default under '/tmp/BasiliX', which is
world-readable and apparently never emptied by BasiliX itself. As a
result, anyone with shell access on the affected system or who can place
CGI files on it can access attachments uploaded to BasiliX.
See also :
http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0117.html
Solution :
Upgrade to BasiliX version 1.1.1 or later.
Threat Level:
Low / CVSS Base Score : 2
(AV:L/AC:L/Au:NR/C:P/A:N/I:N/B:C)
Click HERE for more information and discussions on this network vulnerability scan.
|