CVE-2005-2956: Medium severity adaptive technology resource centre atutor vulnerability
ATutor 1.5.1, and possibly earlier versions, stores temporary chat logs under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain user chat conversations via direct requests to those files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2956?
CVE-2005-2956 is classified as having a high severity due to the risk of exposing sensitive user chat logs.
How do I fix CVE-2005-2956?
To fix CVE-2005-2956, implement proper access controls on the directory storing temporary chat logs and ensure that filenames are not predictable.
Who is affected by CVE-2005-2956?
CVE-2005-2956 affects ATutor versions 1.5.1 and possibly earlier versions that store chat logs improperly.
What potential impact does CVE-2005-2956 have?
CVE-2005-2956 allows remote attackers to access and obtain confidential user conversations, leading to privacy violations.
What should users do if they are using a vulnerable version related to CVE-2005-2956?
Users of vulnerable versions should immediately upgrade to a patched version of ATutor and review their security settings.