Overview
Easynews does not adequately validate user input. Attackers may exploit this vulnerability to learn the filesystem path where the script is installed.
Description
Easynews is an open-source CGI script designed to create dynamic news story web pages and listings. Easynews does not properly filter input from an unspecified CGI variable. By setting the value of this variable to a non-number, an attacker can cause the script to crash and display the filesystem path where the script is installed. |
Impact
An attacker can learn the filesystem path of the Easynews script, which includes the server's web directory. |
Solution
The CERT/CC is currently unaware of a practical solution to this problem. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to Markus Arndt for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
Other Information
| CVE IDs: | None |
| Severity Metric: | 0.86 |
| Date Public: | 2001-12-01 |
| Date First Published: | 2002-09-24 |
| Date Last Updated: | 2002-09-24 17:42 UTC |
| Document Revision: | 4 |