|
|
Info |
Last Modified |
| about 1 year ago |
|
|
|
|
|
Description |
Greymatter allows a remote attacker to retrieve a file that contains the administrative login and password stored in plaintext. The issue is due to the package storing this information in a file named "gmrightclick*reg" (where * is a six digit number) and being readable via the web server. With this information, an attacker can login with administrative privileges and have full control over the Greymatter installation.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Available
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Solution |
Upgrade to version 1.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
Greymatter
 |
1.21a |
1.21b |
1.21c |
|
|
|
|
Credit |
- security curmudgeon - jericho
 attrition.org - attrition.org
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
