TestLink 1.9.12 Path Disclosure

2014.10.24
Credit: Egidio Romano
Risk: Low
Local: No
Remote: Yes
CWE: CWE-200


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

---------------------------------------------------------------- TestLink <= 1.9.12 (database.class.php) Path Disclosure Weakness ---------------------------------------------------------------- [-] Software Link: http://testlink.org/ [-] Affected Versions: Version 1.9.12 and prior versions. [-] Weakness Description: The vulnerable code is located in the /lib/functions/database.class.php script: 208. if(defined('DBUG_ON') && DBUG_ON == 1) 209. { 210. echo "<pre>"; debug_print_backtrace(); echo "</pre>"; 211. } 212. else 213. { 214. echo "<pre>"; debug_print_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS); echo "</pre>"; 215. } The weakness exists due to this script reveals debug information generated by the "debug_print_backtrace()" function. This can be exploited to gain knowledge of the web root directory by sending direct requests to certain scripts. [-] Solution: Update to version 1.9.13 when will be released or apply these hotfixes: http://mantis.testlink.org/view.php?id=6609 [-] Disclosure Timeline: [06/10/2014] - Issue reported to http://mantis.testlink.org/view.php?id=6651 [07/10/2014] - Issue fixed in the Git repository: http://goo.gl/AnOAi6 [08/10/2014] - CVE number requested [11/10/2014] - CVE number assigned [23/10/2014] - Public disclosure [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2014-8082 to this weakness. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: http://karmainsecurity.com/KIS-2014-12

References:

http://karmainsecurity.com/KIS-2014-12


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top