Baruwa Admin 'Edit/Delete' User Pages Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	59373
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 21 2013 12:00AM
Updated:	Apr 21 2013 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Andrew Colin Kissa Baruwa 2.0
Not Vulnerable:	Andrew Colin Kissa Baruwa 2.0.1

Baruwa Admin 'Edit/Delete' User Pages Multiple Information Disclosure Vulnerabilities

Baruwa is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to obtain sensitive information that may aid in launching further attacks.

Baruwa 2.0.0 is vulnerable; other versions may also be affected.

Baruwa Admin 'Edit/Delete' User Pages Multiple Information Disclosure Vulnerabilities

An attacker can exploit these issues using a web browser.

Baruwa Admin 'Edit/Delete' User Pages Multiple Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Baruwa Admin 'Edit/Delete' User Pages Multiple Information Disclosure Vulnerabilities

References:

• Baruwa 2.0.1 Security release issued (Andrew Colin Kissa)
  
• Baruwa Homepage (Andrew Colin Kissa)