CVE-2004-1912: Medium severity Francisco Burzi PHP-Nuke vulnerability

Published Dec 31, 2004

Updated

The (1) modules.php, (2) block-Calendar.php, (3) block-Calendar1.php, (4) block-Calendarcenter.php scripts in NukeCalendar 1.1.a, as used in PHP-Nuke, allow remote attackers to obtain sensitive information via a URL with an invalid argument, which reveals the full path in an error message.

Affected Software

2 affected components

Francisco Burzi PHP-Nuke=8.0_final

Shiba-design Nukecalendar=1.1.a

Event History

Dec 31, 2004

CVE Published

05:00 AM

May 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1912?

CVE-2004-1912 has been classified as a medium severity vulnerability as it allows sensitive information disclosure.

How do I fix CVE-2004-1912?

To fix CVE-2004-1912, update NukeCalendar to a version that patches the vulnerability or ensure error messages do not reveal sensitive information.

What versions are affected by CVE-2004-1912?

CVE-2004-1912 affects PHP-Nuke version 8.0_final and NukeCalendar version 1.1.a.

What type of vulnerability is CVE-2004-1912?

CVE-2004-1912 is an information disclosure vulnerability allowing attackers to view the path of the scripts used.

Who is the vendor for the CVE-2004-1912 vulnerability?

The affected software in CVE-2004-1912 is from the PHP-Nuke project and the Shiba Design for NukeCalendar.