OSVDB ID: 24237

Title: @1 Event Publisher eventpublisher.txt Direct Request Private Comment Disclosure

Info

Disclosure

Mar 29, 2006

Discovery

Mar 23, 2006

Dates

Exploit

Mar 29, 2006

Solution

Unknown

Description

@1 Event Publisher contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when an attacker makes a direct request to the eventpublisher.txt file, which will disclose private comments resulting in a loss of confidentiality.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workaround: Customers can add in the "@1 Script Secure code" to help secure the code

Products

UPDI Network Enterprise

@1 Event Publisher

2003-12-18

References

Secunia Advisory ID: 19727
CVE ID: 2006-1437 (see also: NVD)
Related OSVDB ID: 24235 24236
Other Advisory URL: http://osvdb.org/ref/24/24236-upoint.txt
Vendor URL: https://www.upoint.info/

Credit

security curmudgeon - jerichoattrition.org - attrition.org

Direct URL: http://osvdb.org/24237