CVE-2003-1297 — MEDIUM (5.0)

Vulnerability Description

Easy File Sharing (EFS) Web Server 1.2 stores the (1) option.ini (aka options.ini) file and (2) log directory under the web root with insufficient access control, which allows remote attackers to obtain sensitive information including an SMTP account username and password hash, the server configuration, and server log files.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Efs Software	Efs Web Server	1.2

References

http://archives.neohapsis.com/archives/bugtraq/2003-10/0083.htmlExploit
http://www.osvdb.org/23794ExploitPatch
http://www.osvdb.org/23795ExploitPatch
http://archives.neohapsis.com/archives/bugtraq/2003-10/0083.htmlExploit
http://www.osvdb.org/23794ExploitPatch
http://www.osvdb.org/23795ExploitPatch

FAQ

What is CVE-2003-1297?

CVE-2003-1297 is a vulnerability with a CVSS score of 5.0 (MEDIUM). Easy File Sharing (EFS) Web Server 1.2 stores the (1) option.ini (aka options.ini) file and (2) log directory under the web root with insufficient access control, which allows remote attackers to obta...

How severe is CVE-2003-1297?

CVE-2003-1297 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2003-1297?

Check the references section above for vendor advisories and patch information. Affected products include: Efs Software Efs Web Server.