PyBlosxom PATH_INFO File Disclosure Vulnerability

Bugtraq ID:	16641
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 09 2005 12:00AM
Updated:	Dec 22 2006 12:03AM
Credit:	The vendor reported this vulnerability.
Vulnerable:	PyBlosxom PyBlosxom 1.3.1 PyBlosxom PyBlosxom 1.3
Not Vulnerable:	PyBlosxom PyBlosxom 1.3.2

PyBlosxom PATH_INFO File Disclosure Vulnerability

PyBlosxom is prone to a file-disclosure vulnerability. This is due to incorrect handling of the 'PATH_INFO' variable.

A remote attacker may exploit this vulnerability to reveal files that contain potentially sensitive information.

PyBlosxom PATH_INFO File Disclosure Vulnerability

No exploit is required.

PyBlosxom PATH_INFO File Disclosure Vulnerability

Solution:
Please see the references for more information.


PyBlosxom PyBlosxom 1.3

• PyBlosxom pyblosxom-1.3.2.tar.gz
  pyblosxom-1.3.2.
  http://prdownloads.sourceforge.net/pyblosxom/pyblosxom-1.3.2.tar.gz

PyBlosxom PyBlosxom 1.3.1

• PyBlosxom pyblosxom-1.3.2.tar.gz
  pyblosxom-1.3.2.
  http://prdownloads.sourceforge.net/pyblosxom/pyblosxom-1.3.2.tar.gz

PyBlosxom PATH_INFO File Disclosure Vulnerability

References:

• PyBlosxom Web Site (PyBlosxom)