ID de Prueba:	1.3.6.1.4.1.25623.1.0.12068
Categoría:	Web application abuses
Título:	X-News '/db/users.txt' Information Disclosure Vulnerability
Resumen:	X-News is prone to an information disclosure vulnerability.
Descripción:	Summary: X-News is prone to an information disclosure vulnerability. Vulnerability Insight: X-News stores user ids and passwords, as MD5 hashes, in a world- readable file, 'db/users.txt'. This is the same information that is issued by X-News in cookie-based authentication credentials. Vulnerability Impact: An attacker may incorporate this information into cookies and then submit them to gain unauthorized access to the X-News administrative account. Solution: Deny access to the files in the 'db' directory through the webserver. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2002-1656 BugTraq ID: 4283 http://www.securityfocus.com/bid/4283 CERT/CC vulnerability note: VU#162723 http://www.kb.cert.org/vuls/id/162723 http://www.ifrance.com/kitetoua/tuto/x_holes.txt http://securitytracker.com/id?1003828 XForce ISS Database: xnews-users-world-readable(8465) https://exchange.xforce.ibmcloud.com/vulnerabilities/8465
Copyright	Copyright (C) 2004 Audun Larsen

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.