|
|
Info |
Last Modified |
| 8 months ago |
|
|
|
|
Description |
appweb contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when using request with HTTP TRACE method in conjonction with certain browsers, which will disclose users's cookies or authentication data information resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure,
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Exploit:
Exploit Unknown
Disclosure:
OSVDB Verified
OSVDB:
Web Related
|
|
Solution |
Upgrade to version 2.2.2 or higher, as it has been reported to fix this vulnerability.(TRACE method is disabled by default)
Additionally, implementing the following change: set the 'TraceMethod' option to 'off' in appweb.conf.
|
|
Products |
|
AppWeb
 |
1.x.x |
2.0.x |
2.1.x |
2.2.0 |
2.2.1 |
0.x.x |
|
|
|
|
Credit |
- Michael O'Brien - <mob
 mbedthis.com>: - MbedThis
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
