GForge Multiple Information Disclosure Vulnerabilities
BID:12318
Info
GForge Multiple Information Disclosure Vulnerabilities
| Bugtraq ID: | 12318 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 20 2005 12:00AM |
| Updated: | Jan 20 2005 12:00AM |
| Credit: | Discovery of these vulnerabilities is credited to Jeremy Bae. |
| Vulnerable: |
GForge GForge 3.21 GForge GForge 3.3 GForge GForge 3.2 GForge GForge 3.1 |
| Not Vulnerable: |
GForge GForge 4.0 |
Discussion
GForge Multiple Information Disclosure Vulnerabilities
GForge is reported prone to multiple input validation vulnerabilities that may be exploited to disclose directory listings outside of the designated CVS root directory. The vulnerabilites exist due to a lack of sufficient sanitization performed on user supplied URI parameters.
Information that is disclosed in this manner may be used to aid in further attacks that are launched against the target computer.
GForge is reported prone to multiple input validation vulnerabilities that may be exploited to disclose directory listings outside of the designated CVS root directory. The vulnerabilites exist due to a lack of sufficient sanitization performed on user supplied URI parameters.
Information that is disclosed in this manner may be used to aid in further attacks that are launched against the target computer.
Exploit / POC
GForge Multiple Information Disclosure Vulnerabilities
No exploit is required.
No exploit is required.
Solution / Fix
GForge Multiple Information Disclosure Vulnerabilities
Solution:
It is reported that these issues are addressed in the 4.x tree of GForge, this is not confirmed. Customers are advised to contact the vendor for details in regards to obtaining and applying an appropriate update.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
It is reported that these issues are addressed in the 4.x tree of GForge, this is not confirmed. Customers are advised to contact the vendor for details in regards to obtaining and applying an appropriate update.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
GForge Multiple Information Disclosure Vulnerabilities
References:
References: