{"api_version":"1","generated_at":"2026-07-23T07:30:46+00:00","cve":"CVE-2004-1572","urls":{"html":"https://cve.report/CVE-2004-1572","api":"https://cve.report/api/cve/CVE-2004-1572.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2004-1572","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2004-1572"},"summary":{"title":"CVE-2004-1572","description":"AJ-Fork 167 does not restrict access to directories such as (1) data, (2) inc, (3) plugins, (4) skins, or (5) tools, which allows remote attackers to list files in those directories via a direct HTTP request.","state":"PUBLISHED","assigner":"mitre","published_at":"2004-12-31 05:00:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://marc.info/?l=bugtraq&m=109664986210763&w=2","name":"http://marc.info/?l=bugtraq&m=109664986210763&w=2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"'Multiple Vulnerabilities in AJ-Fork' - MARC","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://echo.or.id/adv/adv07-y3dips-2004.txt","name":"http://echo.or.id/adv/adv07-y3dips-2004.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"ECHO","mime":"text/plain","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/11301","name":"http://www.securityfocus.com/bid/11301","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"AJ-Fork Insecure Default Permissions Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securitytracker.com/id?1011484","name":"http://securitytracker.com/id?1011484","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"404 Not Found - SecurityTracker - Page Not Found","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17569","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17569","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2004-1572","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2004-1572","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2004","cve_id":"1572","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aj-fork","cpe5":"aj-fork","cpe6":"167","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-08T00:53:24.163Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"11301","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/11301"},{"name":"1011484","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1011484"},{"name":"af-fork-directory-disclosure(17569)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17569"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://echo.or.id/adv/adv07-y3dips-2004.txt"},{"name":"20041001 Multiple Vulnerabilities in AJ-Fork","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://marc.info/?l=bugtraq&m=109664986210763&w=2"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2004-10-01T00:00:00.000Z","descriptions":[{"lang":"en","value":"AJ-Fork 167 does not restrict access to directories such as (1) data, (2) inc, (3) plugins, (4) skins, or (5) tools, which allows remote attackers to list files in those directories via a direct HTTP request."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-10T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"11301","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/11301"},{"name":"1011484","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1011484"},{"name":"af-fork-directory-disclosure(17569)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17569"},{"tags":["x_refsource_MISC"],"url":"http://echo.or.id/adv/adv07-y3dips-2004.txt"},{"name":"20041001 Multiple Vulnerabilities in AJ-Fork","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://marc.info/?l=bugtraq&m=109664986210763&w=2"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2004-1572","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"AJ-Fork 167 does not restrict access to directories such as (1) data, (2) inc, (3) plugins, (4) skins, or (5) tools, which allows remote attackers to list files in those directories via a direct HTTP request."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"11301","refsource":"BID","url":"http://www.securityfocus.com/bid/11301"},{"name":"1011484","refsource":"SECTRACK","url":"http://securitytracker.com/id?1011484"},{"name":"af-fork-directory-disclosure(17569)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/17569"},{"name":"http://echo.or.id/adv/adv07-y3dips-2004.txt","refsource":"MISC","url":"http://echo.or.id/adv/adv07-y3dips-2004.txt"},{"name":"20041001 Multiple Vulnerabilities in AJ-Fork","refsource":"BUGTRAQ","url":"http://marc.info/?l=bugtraq&m=109664986210763&w=2"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2004-1572","datePublished":"2005-02-20T05:00:00.000Z","dateReserved":"2005-02-20T00:00:00.000Z","dateUpdated":"2024-08-08T00:53:24.163Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2004-12-31 05:00:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:aj-fork:aj-fork:167:*:*:*:*:*:*:*","matchCriteriaId":"FAB42474-4D4C-448B-9462-03ED772240EC"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2004","CveId":"1572","Ordinal":"1","Title":"CVE-2004-1572","CVE":"CVE-2004-1572","Year":"2004"},"notes":[{"CveYear":"2004","CveId":"1572","Ordinal":"1","NoteData":"AJ-Fork 167 does not restrict access to directories such as (1) data, (2) inc, (3) plugins, (4) skins, or (5) tools, which allows remote attackers to list files in those directories via a direct HTTP request.","Type":"Description","Title":"CVE-2004-1572"},{"CveYear":"2004","CveId":"1572","Ordinal":"2","NoteData":"2005-02-20","Type":"Other","Title":"Published"},{"CveYear":"2004","CveId":"1572","Ordinal":"3","NoteData":"2017-07-10","Type":"Other","Title":"Modified"}]}}}