|
|
|
|
|
|
|
| |
Multiple Vendor test-cgi Arbitrary File Access |
|
| This script is Copyright (C) 1999-2010 Tenable Network Security, Inc. |
|
|
| Family | CGI abuses |
| Nessus Plugin ID | 10282 (test-cgi.nasl) |
| Bugtraq ID | 2003
|
| CVE ID | CVE-1999-0070
|
|
| Description: |
Synopsis :
The remote web server contains a CGI script that is affected by
information disclosure vulnerabilities.
Description :
The remote web server contains the 'test-cgi' test script, which is
included by default with some web servers.
The version of this script on the remote host fails to quote input to
several environment variables, such as 'QUERY_STRING', before echoing
it back as part of a shell script. An unauthenticated attacker can
leverage this issue to list the contents of directories on the remote
host, subject to the permissions of the web server user id.
See also :
http://www.securityfocus.com/advisories/582
Solution :
Disable or delete the CGI script.
Risk factor :
Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N)
|
|
|
|
|
|
