WebTrends Reporting Server Script Source Code Disclosure Vulnerability

Bugtraq ID:	2812
Class:	Input Validation Error
CVE:	CVE-2001-0693
Remote:	Yes
Local:	No
Published:	Jun 03 2001 12:00AM
Updated:	Jul 11 2009 06:06AM
Credit:	This vulnerability was posted to BugTraq by Auriemma Luigi <[email protected]> on June 3rd, 2001.
Vulnerable:	WebTrends WebTrends Enterprise Reporting Server NT 3.5 WebTrends WebTrends Enterprise Reporting Server 3.1 c
Not Vulnerable:	WebTrends WebTrends Enterprise Reporting Server Solaris 3.5 WebTrends WebTrends Enterprise Reporting Server Linux 3.5

WebTrends Reporting Server Script Source Code Disclosure Vulnerability

WebTrends Live is a web-based reporting service which provides interactive tracking of usage statistics and E-commerce revenue.

It is possible to view the source code of arbitrary scripts on the WebTrends Live webserver. This is accomplished by crafting a URL with an encoded space after the filename of the script.

WebTrends Reporting Server Script Source Code Disclosure Vulnerability

There is no exploit required. This vulnerability can be exploited with a web browser.

Auriemma Luigi <[email protected]> posted this example to BugTraq on June 3rd, 2001:


http://host/remote_login.pl%20

WebTrends Reporting Server Script Source Code Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

WebTrends Reporting Server Script Source Code Disclosure Vulnerability

References:

• WebTrends Live (WebTrends)