| Title | DotClear における重要な情報を取得される脆弱性 |
|---|---|
| Summary | DotClear は、エラーメッセージ内でインストールパスを表示する不備があるため、重要な情報を取得される脆弱性が存在します。 |
| Possible impacts | 第三者により、以下の php への直接リクエストを介して、重要な情報を取得される可能性があります。 (1) ecrire/tools/blogroll/ 内の edit_cat.php (2) ecrire/tools/blogroll/ 内の index.php (3) ecrire/tools/blogroll/ 内の edit_link.php (4) /ecrire/tools/ 内の syslog/index.php (5) /ecrire/tools/ 内の thememng/index.php (6) /ecrire/tools/ 内の toolsmng/index.php (7) /ecrire/tools/ 内の utf8convert/index.php (8) /ecrire/inc/connexion.php (9) /inc/session.php (10) /inc/classes/ 内の class.blog.php (11) /inc/classes/ 内の class.blogcomment.php (12) /inc/classes/ 内の class.blogpost.php (13) /layout/ 内の append.php (14) /layout/ 内の class.xblog.php (15) /layout/ 内の class.xblogcomment.php (16) /layout/ 内の class.xblogpost.php (17) /themes/default/ 内の form.php (18) /themes/default/ 内の list.php (19) /themes/default/ 内の post.php (20) /themes/default/ 内の template.php |
| Solution | ベンダ情報および参考情報を参照して適切な対策を実施してください。 |
| Publication Date | July 31, 2006, midnight |
| Registration Date | Dec. 20, 2012, 6:02 p.m. |
| Last Update | Dec. 20, 2012, 6:02 p.m. |
| CVSS2.0 : 警告 | |
| Score | 5 |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| Dotclear |
| Dotclear |
| No | Changed Details | Date of change |
|---|---|---|
| 0 | [2012年12月20日] 掲載 |
Feb. 17, 2018, 10:37 a.m. |
| Summary | DotClear allows remote attackers to obtain sensitive information via a direct request for (1) edit_cat.php, (2) index.php, (3) edit_link.php in ecrire/tools/blogroll/; (4) syslog/index.php, (5) thememng/index.php, (6) toolsmng/index.php, (7) utf8convert/index.php in /ecrire/tools/; (8) /ecrire/inc/connexion.php and (9) /inc/session.php; (10) class.blog.php, (11) class.blogcomment.php, (12) and class.blogpost.php in /inc/classes/; (13) append.php, (14) class.xblog.php, (15) class.xblogcomment.php, and (16) class.xblogpost.php in /layout/; (17) form.php, (18) list.php, (19) post.php, or (20) template.php in /themes/default/, which reveal the installation path in error messages. |
|---|---|
| Publication Date | Aug. 1, 2006, 7:04 a.m. |
| Registration Date | Jan. 29, 2021, 3:42 p.m. |
| Last Update | Oct. 18, 2018, 6:32 a.m. |
| Configuration1 | or higher | or less | more than | less than | |
| cpe:2.3:a:dotclear:dotclear:1.2.1:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:dotclear:dotclear:1.2.2:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:dotclear:dotclear:1.2.3:*:*:*:*:*:*:* | |||||
| cpe:2.3:a:dotclear:dotclear:1.2.4:*:*:*:*:*:*:* | |||||