CVE-2005-1698 — MEDIUM (5.0)

Vulnerability Description

PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) text.php, (6) html.php, (7) menu.php, (8) finclude.php, or (9) button.php in the pnblocks directory in the Blocks module, (10) config.php in the NS-Multisites (aka Multisites) module, or (11) xmlrpc.php, which reveals the path in an error message.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Postnuke	Postnuke	0.750

Related Weaknesses (CWE)

CWE-425

References

http://marc.info/?l=bugtraq&m=111670506926649&w=2Third Party Advisory
http://marc.info/?l=bugtraq&m=111670506926649&w=2Third Party Advisory

FAQ

What is CVE-2005-1698?

CVE-2005-1698 is a vulnerability with a CVSS score of 5.0 (MEDIUM). PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2) Xanthia.php in the Xanthia module, (3) user.php, (4) thelang.php, (5) t...

How severe is CVE-2005-1698?

CVE-2005-1698 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2005-1698?

Check the references section above for vendor advisories and patch information. Affected products include: Postnuke Postnuke.