CVE-2007-4873 SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated....
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simplenews | = 2.41.03 | No fix listed |
References
- forum.boesch-it.de
- 20070925 SimpNews version 2.41.03 File Content Disclosure Vulnerability mailing-list
- 45479 vdb-entry
- 3173 third-party-advisory
- www.netvigilance.com vendor-advisory
- 20070925 SimpNews version 2.41.03 File Content Disclosure Vulnerability mailing-list
- simpnews-dbtables-information-disclosure(36778) vdb-entry