CVE-1999-0953: Critical severity Matt Wright Wwwboard vulnerability
WWWBoard stores encrypted passwords in a password file that is under the web root and thus accessible by remote attackers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Move the WWWBoard password file from the web-accessible document root to a directory not served by the web server, and update WWWBoard configuration to reference the new location.
WWWBoard password_file_location = move outside web root - Configuration
Configure the web server (or use .htaccess or equivalent) to explicitly deny HTTP access to the password file or its containing directory so the file cannot be retrieved via HTTP.
Web server / WWWBoard HTTP access to password file = deny - Configuration
Restrict filesystem permissions on the password file so only the application process and administrators can read it (remove read access for web/other users).
WWWBoard password file permissions = restrict - Compensating control
If you cannot immediately relocate the file, deploy a temporary server-level or WAF rule to block HTTP requests to the password file path until a permanent fix is implemented.
- Operational
Rotate all passwords and credentials stored in the WWWBoard password file (and any credentials that may have been exposed) after access controls and file relocation are applied.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0953?
CVE-1999-0953 has a high severity due to the exposure of encrypted passwords in a publicly accessible password file.
How do I fix CVE-1999-0953?
To fix CVE-1999-0953, move the password file outside the web root directory to protect it from remote access.
What software is affected by CVE-1999-0953?
CVE-1999-0953 specifically affects WWWBoard version 2.0_alpha_2.1.
What is the impact of CVE-1999-0953?
The impact of CVE-1999-0953 allows remote attackers to access encrypted passwords, potentially leading to unauthorized access.
Is CVE-1999-0953 still relevant today?
While CVE-1999-0953 is an older vulnerability, it highlights ongoing risks related to insecure password storage practices in web applications.