Mercury Messenger Users Directory Information Disclosure Vulnerability

Bugtraq ID:	19005
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 17 2006 12:00AM
Updated:	Jul 18 2006 05:48PM
Credit:	Hans Wolters is credited with the discovery of this vulnerability.
Vulnerable:	Mercury Messenger Mercury Messenger 0
Not Vulnerable:

Mercury Messenger Users Directory Information Disclosure Vulnerability

Mercury Messenger is prone to an information-disclosure vulnerability.

This issue is due to an error in the '/Users' directory of the application.

An attacker can exploit this issue by navigating to the affected directory and accessing arbitrary files.

This will lead to the disclosure of sensitive information that the attacker may use in other attacks.

Mercury Messenger Users Directory Information Disclosure Vulnerability

Attackers can exploit this issue through a web client.

Mercury Messenger Users Directory Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Mercury Messenger Users Directory Information Disclosure Vulnerability

References:

• Mercury Messenger Web Site (Mercury Messenger)
  
• Mercury Messenger (Hans Wolters )