|
|
|
|
|
|
|
| |
Informix webdriver CGI Unauthenticated Database Access |
|
| This script is Copyright (C) 2000-2010 Tenable Network Security, Inc. |
|
|
| Family | CGI abuses |
| Nessus Plugin ID | 10592 (webdriver.nasl) |
| Bugtraq ID | 2166
|
| CVE ID |
|
|
| Description: |
Synopsis :
The remote web server contains a CGI script that may fail to restrict
access to an installed database.
Description :
The remote host may be running Informix Webdriver, a web-to-database
interface. If not configured properly, this CGI script may give an
unauthenticated attacker the ability to modify and even delete
databases on the remote host.
*** Nessus relied solely on the presence of this CGI
it did not
*** try to determine if the installed version is vulnerable to
*** that problem.
See also :
http://archives.neohapsis.com/archives/bugtraq/2001-01/0002.html
http://archives.neohapsis.com/archives/bugtraq/2001-01/0043.html
Solution :
Consult the product documentation to properly configure the script.
Risk factor :
Medium / CVSS Base Score : 5.1
(CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P)
|
|
|
|
|
|
