|
|
Info |
Last Modified |
| about 1 year ago |
|
|
|
|
|
Description |
Note-A-Day contains a flaw that may lead to an unauthorized information disclosure. The issue is present because the 'archive/.phpass-admin' file containing encrypted user credentials (including the administrator's credentials) is located within the web path and can be accessed directly, resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
OSVDB:
Web Related
|
|
Solution |
Upgrade to version 3.0 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround: In the Apache configuration or .htaccess file, use access controls.
<Files ~ "^\.phpass-">
Order allow,deny
Deny from all
</Files>
|
|
Products |
|
Note-A-Day
 |
2.2 |
2.1 |
|
|
|
|
Credit |
- Aliaksandr Hartsuyeu - alex
 evuln.com - eVuln
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
