OpenBB Private Message Disclosure Vulnerability

Bugtraq ID:	10217
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Apr 26 2004 12:00AM
Updated:	Apr 26 2004 12:00AM
Credit:	Disclosure of this issue is credited to Manuel Lopez <[email protected]>.
Vulnerable:	OpenBB OpenBB 1.0.6 OpenBB OpenBB 1.0.5 OpenBB OpenBB 1.0 .0 RC3 OpenBB OpenBB 1.0 .0 RC2 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 OpenBB OpenBB 1.0 .0 RC1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 OpenBB OpenBB 1.0 .0 beta1 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17
Not Vulnerable:

OpenBB Private Message Disclosure Vulnerability

It has been reported that OpenBB is affected by a private message disclosure vulnerability. This issue is due to a design error that fails to validate user credentials.

This issue might allow an attacker to read arbitrary private messages posted to the bulletin board; limiting confidentiality.

OpenBB Private Message Disclosure Vulnerability

No exploit is required to leverage this issue. The following proof of concept has been provided:

http:/www.example.com/forum/myhome.php?action=readmsg&id=[message_id]&box=inbox

OpenBB Private Message Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

OpenBB Private Message Disclosure Vulnerability

References:

• OpenBB Homepage (OpenBB)
  
• Multiple Vulnerabilities In OpenBB (JeiAr )