CVE-2004-2748 viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an....

MediumCVSS 4.3 EPSS 4.8% Public exploit

Published: 2007-11-08 22:00
Updated: 2026-06-17 01:10
Exploit status: Public exploit available

Description

viewreport.pl in NetIQ WebTrends Reporting Center Enterprise Edition 6.1a allows remote attackers to determine the installation path via an invalid profileid parameter, which leaks the pathname in an error message.

Affected products

Product	Affected versions	Fixed in
webtrends reporting center	= 6.1a	No fix listed

References

10689 third-party-advisory vendor-advisory
3354 third-party-advisory
3680 vdb-entry
20040120 WebTrends Reporting Center Path Disclosure vulnerability mailing-list
9460 vdb-entry
1008799 vdb-entry

CVSS v2.0

4.3 Medium

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 4.81% (percentile 92.1)
CWE: CWE-200

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

WebTrends Reporting Center 6.1 Management Interface - Full Path Disclosure Exploit · Exploit Database (OffSec) · 2004-01-20