CVE-2008-5899 CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator pass...
HighCVSS 7.5
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CodeAvalanche FreeForAll stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing the administrator password via a direct request for _private/CAFFAPage.mdb. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| codeavalanche freeforall | = _nil_ | No fix listed |
References
- 33100 third-party-advisory vendor-advisory
- freeforall-caffapage-info-disclosure(47354) vdb-entry
- 7469 exploit