CVE-2007-4872 SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct request to (2) admin/dbg_infos.php, (3) admin/heading.php, or...
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SimpNews 2.41.03 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php; or a direct request to (2) admin/dbg_infos.php, (3) admin/heading.php, or (4) evsearch.php; which reveals the path in various error messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplenews | = 2.41.03 | No fix listed |
References
- forum.boesch-it.de
- 20070925 SimpNews version 2.41.03 Multiple Path Disclosure Vulnerabilities mailing-list
- 43540 vdb-entry
- 43541 vdb-entry
- 43542 vdb-entry
- 43543 vdb-entry
- 3174 third-party-advisory
- www.netvigilance.com vendor-advisory
- 20070925 SimpNews version 2.41.03 Multiple Path Disclosure Vulnerabilities mailing-list
- simpnews-multiple-information-disclosure(36779) vdb-entry