PT-2012-5285
CVE-2012-4257
·
تاريخ النشر
2012-08-13
·
تاريخ التحديث
2017-08-29
الوصف من
CVSS 2.0
5.0
متوسطةالمقاييسAV:N/AC:L/Au:N/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Yaqas (Yet Another Question & Answer System) version 1.0 Alpha 1
Description
The issue allows remote attackers to obtain sensitive information via an invalid character in the
PHPSESSID, which reveals the installation path in an error message.Recommendations
For Yaqas (Yet Another Question & Answer System) version 1.0 Alpha 1, consider validating and sanitizing user input to prevent the injection of invalid characters into the
PHPSESSID. As a temporary workaround, restrict access to error messages that may reveal sensitive information about the installation path.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾