CVE-2004-2572 Information disclosure in n/a
Remote attackers can obtain sensitive path information via crafted input in the Lookup field, exposing internal file paths in error messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2004-2572?
CVE-2004-2572 is a medium-severity vulnerability in n/a, published on 22 Nov 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
Which versions are affected by CVE-2004-2572?
It affects 1 product.
Products include Amax Information Technologies Magic Winmail Server.
How do I fix CVE-2004-2572?
No fix has been published for CVE-2004-2572 yet. Limit exposure of the affected software until one is available.
Is CVE-2004-2572 being exploited?
There is no known exploitation of CVE-2004-2572 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hxrh-xvf9-9m4h.