Information disclosure in Digitiliti Digilibe

CVE-2013-1402

DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration information via a direct request to configuration/general_configuration.html.

Vulnerability class: Information Disclosure

EPSS: 0.063 (92.9th percentile) — read the EPSS interpretation.

Affected products

Digitiliti Digilibe — versions 3.4
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (mailing-list, Exploit, x_refsource_BUGTRAQ)