CVE-2006-4735 - Kellan Elliott-McCrea MagpieRSS allows remote attackers to obtain sensitive information via a direct

CVE-2006-4735

Summary

Kellan Elliott-McCrea MagpieRSS allows remote attackers to obtain sensitive information via a direct request for (1) rss_fetch.inc.php or (2) rss_parse.inc.php, which reveals the path in various error messages.

References

http://securityreason.com/securityalert/1564
http://www.securityfocus.com/archive/1/445729/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/28858

Vulnerable Configurations

cpe:2.3:a:kellan_elliott-mccrea:magpierss:*:*:*:*:*:*:*:*
cpe:2.3:a:kellan_elliott-mccrea:magpierss:*:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 17-10-2018 - 21:39)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bugtraq	20060911 MagpieRSS (a simple RSS integration tool) Full path vul
sreason	1564
xf	magpierss-multiple-path-disclosure(28858)

Last major update

17-10-2018 - 21:39

Published

13-09-2006 - 22:07

Last modified

17-10-2018 - 21:39