Information disclosure in Tiki Tikiwiki Cms\/groupware

CVE-2006-6457

tiki-wiki_rss.php in Tikiwiki 1.9.5, 1.9.2, and possibly other versions allows remote attackers to obtain sensitive information (MySQL username and password) via an invalid (large or negative) ver parameter, which leaks the information in an error message.

Vulnerability class: Information Disclosure

EPSS: 0.012 (64.6th percentile) — read the EPSS interpretation.

Affected products

Tiki Tikiwiki_cms\/groupware — versions 1.9.2, 1.9.5
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)