Information disclosure in Deerfield Visnetic Website
CVE-2003-0456
VisNetic WebSite 3.5 allows remote attackers to obtain the full pathname of the server via a request containing a folder that does not exist, which leaks the pathname in an error message, as demonstrated using _vti_bin/fpcount.exe.
Vulnerability class: Information Disclosure
EPSS: 0.028 (84.8th percentile) — read the EPSS interpretation.
Affected products
- Deerfield Visnetic_website — versions 3.5.13, 3.5.15, 3.5.17
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_VULNWATCH, Exploit, Patch)
- cve@mitre.org (vdb-entry, x_refsource_XF)