Описание
TowerBlog 0.6 and earlier stores the login data file under the web root, which allows remote attackers to obtain the MD5 checksums of the username and password via a direct request to the _dat/login file.
Ссылки
- Vendor Advisory
- PatchVendor Advisory
- Vendor Advisory
- PatchVendor Advisory
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:towerblog:towerblog:0.2:*:*:*:*:*:*:*
cpe:2.3:a:towerblog:towerblog:0.4_r1:*:*:*:*:*:*:*
cpe:2.3:a:towerblog:towerblog:0.6:*:*:*:*:*:*:*
cpe:2.3:a:towerblog:towerblog:0.6_r1:*:*:*:*:*:*:*
EPSS
Процентиль: 77%
0.01075
Низкий
7.5 High
CVSS2
Дефекты
NVD-CWE-Other
Связанные уязвимости
github
почти 4 года назад
TowerBlog 0.6 and earlier stores the login data file under the web root, which allows remote attackers to obtain the MD5 checksums of the username and password via a direct request to the _dat/login file.
EPSS
Процентиль: 77%
0.01075
Низкий
7.5 High
CVSS2
Дефекты
NVD-CWE-Other