CVE-2006-0370

Noah Medling RCBlog 1.03 stores the data and config directories under the web root with insufficient access control, which allows remote attackers to view account names and MD5 password hashes.

Published Bycve@mitre.org

Published DateJan 22, 2006, 20:03

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

Vector String

AV:N/AC:L/Au:N/C:P/I:N/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

NONE

Availability (A)

NONE

References

http://evuln.com/vulns/42/summary.html
http://secunia.com/advisories/18547
http://securitytracker.com/id?1015523
http://www.fluffington.com/index.php?page=rcblog
http://www.osvdb.org/22679
http://www.securityfocus.com/archive/1/422499/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/24249

Weakness Type (CWE):NVD-CWE-Other

CVSS Metrics

Base Score

Vector String

AV:N/AC:L/Au:N/C:P/I:N/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

NONE

Availability (A)

NONE