Revize CMS Revize.XML Information Disclosure Vulnerability

Bugtraq ID:	15482
Class:	Access Validation Error
CVE:	CVE-2005-3728
Remote:	Yes
Local:	No
Published:	Nov 17 2005 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	Lostmon is credited with the discovery of this vulnerability.
Vulnerable:	Revize CMS Revize CMS
Not Vulnerable:

Revize CMS Revize.XML Information Disclosure Vulnerability

Revize CMS is prone to an information disclosure vulnerability. This issue is due to a failure in the application to restrict access to sensitive files.

An attacker can exploit this vulnerability to retrieve sensitive information. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

Revize CMS Revize.XML Information Disclosure Vulnerability

No exploit is required.

A sample URI has been provided:

http://www.example.com/revize/conf/revise.xml

Revize CMS Revize.XML Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Revize CMS Revize.XML Information Disclosure Vulnerability

References:

• Revize Web Page (Revize)
  
• Revize(r) CMS SQL information disclosure and XSS (Lostmon)