CVE-2004-1937: Medium severity Nuked-Klan Nuked-KlaN vulnerability
Multiple directory traversal vulnerabilities in Nuked-KlaN 1.4b and 1.5b allow remote attackers to read or include arbitrary files via .. sequences in (1) the userlangue parameter to index.php or (2) the langue parameter to update.php, or modify arbitrary GLOBAL variables by causing globals.php to be loaded before conf.inc.php via (3) .. sequences in the file parameter with the page parameter set to globals, or (4) ../globals.php in the userlangue parameter, as demonstrated by modifying $nuked[prefix] in the Suggest module.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1937?
CVE-2004-1937 is considered a medium severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2004-1937?
To fix CVE-2004-1937, upgrade to a patched version of Nuked-KlaN that mitigates directory traversal risks.
Which versions of Nuked-KlaN are affected by CVE-2004-1937?
CVE-2004-1937 affects Nuked-KlaN versions 1.4b and 1.5b, along with earlier versions like 1.2 and 1.3.
What type of attacks are possible with CVE-2004-1937?
CVE-2004-1937 allows remote attackers to perform directory traversal attacks to read or include arbitrary files.
Is user input validation relevant to CVE-2004-1937?
Yes, inadequate user input validation in the parameters user_langue and langue contributes to the exploitation of CVE-2004-1937.