Lucene search

MitreCVE-2006-5316

HistoryOct 17, 2006 - 5:07 p.m.

CVE-2006-5316

2006-10-1717:07:00

mitre

web.nvd.nist.gov

registrotl

sensitive information

web root

access control

remote attackers

database download

usuarios.dat

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

AI Score

6.7

Confidence

Low

EPSS

0.005

Percentile

76.0%

JSON

registroTL stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for /usuarios.dat.

Affected configurations

Nvd

Node

phplibreregistrotlMatch0.1b

phplibreregistrotlMatch0.5b

VendorProductVersionCPE
phplibreregistrotl0.1bcpe:2.3:a:phplibre:registrotl:0.1b:*:*:*:*:*:*:*
phplibreregistrotl0.5bcpe:2.3:a:phplibre:registrotl:0.5b:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
phplibre	registrotl	0.1b	cpe:2.3:a:phplibre:registrotl:0.1b:::::::*
phplibre	registrotl	0.5b	cpe:2.3:a:phplibre:registrotl:0.5b:::::::*

References

acid-root.new.fr/poc/13061007.txt

securityreason.com/securityalert/1734

www.securityfocus.com/archive/1/448096/100/0/threaded

www.exploit-db.com/exploits/2502

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

AI Score

6.7

Confidence

Low

EPSS

0.005

Percentile

76.0%

JSON

Related for CVE-2006-5316