Invision Power Board Threaded View Information Disclosure Vulnerability

Bugtraq ID:	19483
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 11 2006 12:00AM
Updated:	Aug 11 2006 11:35PM
Credit:	The vendor disclosed this vulnerability.
Vulnerable:	Invision Power Services Invision Board 2.1.7 + Invision Power Services Invision Board 2.1 Invision Power Services Invision Board 2.1.6 + Invision Power Services Invision Board 2.1 Invision Power Services Invision Board 2.1.5 + Invision Power Services Invision Board 2.1 Invision Power Services Invision Board 2.1.4 Invision Power Services Invision Board 2.1 Alpha2 Invision Power Services Invision Board 2.1 + Invision Power Services Invision Board 2.1 Invision Power Services Invision Board 2.1.6 2006-06-19 + Invision Power Services Invision Board 2.1
Not Vulnerable:	Invision Power Services Invision Board 2.1.7 21013.60810.s + Invision Power Services Invision Board 2.1

Invision Power Board Threaded View Information Disclosure Vulnerability

Invision Power Board is prone to an information-disclosure vulnerability because it fails to protect sensitive information.

An attacker can exploit this issue to gain access to sensitive information that could lead to other attacks.

Invision Power Board Threaded View Information Disclosure Vulnerability

Attackers can exploit this issue via a web client.

Invision Power Board Threaded View Information Disclosure Vulnerability

Solution:
The vendor has released patch 21013.60810.s for version 2.1.7; please see the reference section for details.

Invision Power Board Threaded View Information Disclosure Vulnerability

References:

• Invision Board Homepage (Invision Power Services)
  
• IPB 2.1.7 security update (Invision Power Services)