BID:37441

Trac Alternate Formats Policy Check Bypass Information Disclosure Vulnerability

Info

Trac Alternate Formats Policy Check Bypass Information Disclosure Vulnerability

Bugtraq ID:	37441
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 28 2009 12:00AM
Updated:	Apr 16 2015 05:43PM
Credit:	Trac
Vulnerable:	Trac Trac 0.11.5 Trac Trac 0.11.4 Trac Trac 0.11.3 Trac Trac 0.11.2 Trac Trac 0.11.1 Trac Trac 0.11 Trac Trac 0.10.5 Trac Trac 0.10.4 Trac Trac 0.10.3 1 Trac Trac 0.10.3 Trac Trac 0.9.6 Trac Trac 0.9.5 Trac Trac 0.9.4 Nortel Networks VPN Router 1010 0.9.3

Not Vulnerable:	Trac Trac 0.11.6

Discussion

Trac Alternate Formats Policy Check Bypass Information Disclosure Vulnerability

Trac is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to harvest sensitive information that may lead to further attacks.

Versions prior to Trac 0.11.6 are vulnerable.

Exploit / POC

Trac Alternate Formats Policy Check Bypass Information Disclosure Vulnerability

An attacker can exploit this issue using a browser.

Solution / Fix

Trac Alternate Formats Policy Check Bypass Information Disclosure Vulnerability

Solution:
The vendor has released an update. Please see the references for details.

Trac Trac 0.10.3 1