CVE-2006-0202: Low severity Paypal PHP Toolkit vulnerability
Dave Nielsen and Patrick Breitenbach PayPal Web Services (aka PHP Toolkit) 0.50 and possibly earlier has (1) world-readable permissions for ipn/logs/ipnsuccess.txt, which allows local users to view sensitive information (payment data), and (2) world-writable permissions for ipn/logs, which allows local users to delete or replace payment data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-0202?
CVE-2006-0202 is considered a moderate severity vulnerability due to its potential exposure of sensitive payment data.
How do I fix CVE-2006-0202?
To remediate CVE-2006-0202, ensure that the ipn/logs directory permissions are not world-readable and world-writable.
What are the risks associated with CVE-2006-0202?
The risks of CVE-2006-0202 include unauthorized access to sensitive payment information by local users.
Which software versions are affected by CVE-2006-0202?
CVE-2006-0202 affects PayPal Web Services PHP Toolkit versions up to and including 0.50.
Is CVE-2006-0202 exploitable remotely?
CVE-2006-0202 is not considered remotely exploitable since it requires local access to the server.