CVE-2003-1486: Infoleak

Published Dec 31, 2003

Updated

Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quicklistrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forumlistrss.php, (7) forumlistrdf.php, (8) forumlist.php, or (9) move.php, which leaks the information in an error message.

Affected Software

3 affected components

Phorum Phorum=3.4

Phorum Phorum=3.4.1

Phorum Phorum=3.4.2

Remediation

Patch Available

http://www.securityfocus.com/bid/7571

Event History

Dec 31, 2003

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 25, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2003-1486?

CVE-2003-1486 is considered a medium severity vulnerability due to its potential for information disclosure.

How do I fix CVE-2003-1486?

To fix CVE-2003-1486, upgrade Phorum to version 3.4.3 or later, which addresses the issue.

What is the impact of CVE-2003-1486?

The impact of CVE-2003-1486 allows remote attackers to reveal the full path of the web server, aiding further exploitation.

Which versions are affected by CVE-2003-1486?

CVE-2003-1486 affects Phorum versions 3.4, 3.4.1, and 3.4.2.

Can I mitigate CVE-2003-1486 without an upgrade?

Mitigation options for CVE-2003-1486 are limited, and upgrading is the most effective way to resolve the vulnerability.