CVE-2004-1956: Medium severity postnuke software foundation postnuke vulnerability

Published Apr 21, 2004

Updated

PostNuke 0.7.2.6 allows remote attackers to gain information via a direct HTTP request to files in the (1) includes/blocks directory, (2) pnadodb directory, (3) NS-NewUser module, (4) NS-YourAccount, (5) NS-LostPassword module, or (6) NS-User module which reveals the path to the web server in a PHP error message.

Affected Software

1 affected component

Postnuke Software Foundation Postnuke=0.726

Event History

Apr 21, 2004

CVE Published

04:00 AM

May 10, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-1956?

CVE-2004-1956 is classified as a moderate severity vulnerability.

How do I fix CVE-2004-1956?

To fix CVE-2004-1956, ensure that sensitive directories are protected or removed and update to a later version of PostNuke if available.

What software versions are affected by CVE-2004-1956?

CVE-2004-1956 affects PostNuke version 0.7.2.6 and potentially other versions in the 0.7.x series.

What types of information can be exposed due to CVE-2004-1956?

CVE-2004-1956 can expose paths to the web server through unauthorized access to certain directories and files.

Who can exploit CVE-2004-1956?

CVE-2004-1956 can be exploited by remote attackers without needing any authentication credentials.