Google Mini Search Applicance Path Disclosure

2006.10.01
Risk: Low
Local: No
Remote: Yes
CWE: CWE-Other


Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

aushack.com - Vulnerability Advisory ----------------------------------------------- Release Date: 22-Sep-2006 Software: Google Inc - Google Mini Search Appliance http://www.google.com.au/enterprise/mini/index.html "The Google Mini delivers cost-effective, high-quality search for your public website, intranet, and file servers, and you can be up and running in less than an hour." Versions affected: 4.4.102.M.36 and below. Vulnerability discovered: Reveal web server path. Vulnerability impact: Low - Web server path disclosure. Vulnerability information: User controlled 'client' value. Example (lines may be wrapped): http://mini.site.com.au/search?q=test&client=showmethepathalready Would return the error: "/export/hda3/4.4.102.M.36/local/conf/frontends/showmethepathalready /domain_filter (No such file or directory)" May be able to break out, but not yet found. Fuzz anyone? References: aushack.com advisory http://www.aushack.com/advisories/200609-googlemini.txt Credit: Patrick Webster ( patrick (at) aushack (dot) com [email concealed] ) Disclosure timeline: 22-Sep-2006 - Disclosure. EOF


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top