CVE-2008-6494 ASP User Engine.NET stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for users.mdb.
MediumCVSS 5.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ASP User Engine.NET stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for users.mdb.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| robs-projects asp user engine.net | All versions | No fix listed |
References
- aspuserengine-users-information-disclosure(49400) vdb-entry
- 7332 exploit