CVE-2003-1404
Current Description
DotBr 0.1 stores config.inc with insufficient access control under the web document root, which allows remote attackers to obtain sensitive information such as SQL usernames and passwords.
Basic Data
| Published | December 31, 2003 |
|---|
| Last Modified | July 29, 2017 |
|---|
| Assigner | cve@mitre.org |
|---|
| Data Type | CVE |
|---|
| Data Format | MITRE |
|---|
| Data Version | 4.0 |
|---|
| Problem Type | CWE-200 |
|---|
| CVE Data Version | 4.0 |
|---|
Base Metric V2
| CVSS 2 - Version | 2.0 |
|---|
| CVSS 2 - Vector String | AV:N/AC:L/Au:N/C:P/I:P/A:P |
|---|
| CVSS 2 - Access Vector | NETWORK |
|---|
| CVSS 2 - Access Complexity | LOW |
|---|
| CVSS 2 - Authentication | NONE |
|---|
| CVSS 2 - Confidentiality Impact | PARTIAL |
|---|
| CVSS 2 - Availability Impact | PARTIAL |
|---|
| CVSS 2 - Base Score | 7.5 |
|---|
| Severity | HIGH |
|---|
| Exploitability Score | 10.0 |
|---|
| Impact Score | 6.4 |
|---|
| Obtain All Privilege | false |
|---|
| Obtain User Privilege | false |
|---|
| Obtain Other Privilege | false |
|---|
Base Metric V3
No data provided.
Configurations
-
OR - Configuration 1
| Cpe Version | Part | Vendor | Product | Version | Update | Edition | Language | SW Edition | Target SW | Target HW | Other | Version Start Including | Version End Including | Version Start Excluding | Version End Excluding |
|---|
| 2.3 | Application | Dotbr | Botbr | 0.1 | * | * | * | * | * | * | * | | | | |
Vulnerable Software List
References
| Name | Source | URL | Tags |
|---|
| 20030215 DotBr (PHP) | http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0070.html | VULNWATCH | |
| 5092 | http://www.osvdb.org/5092 | OSVDB | |
| 6865 | http://www.securityfocus.com/bid/6865 | BID | |
| dotbr-config-info-disclosure(11354) | https://exchange.xforce.ibmcloud.com/vulnerabilities/11354 | XF | |
Follow @discotekdotca