Unscored CVE-2003-0456 EUVD-2003-0450GHSA-v54v-27r8-vpr7

VisNetic WebSite 3.5 allows remote attackers to obtain the full pathname of the server via a request containing a folder that does not exis…

Published Jul 15, 2003 · Updated Aug 8, 2024 · Assigned by mitre

Description

VisNetic WebSite 3.5 allows remote attackers to obtain the full pathname of the server via a request containing a folder that does not exist, which leaks the pathname in an error message, as demonstrated using _vti_bin/fpcount.exe.

References

20030701 VisNetic WebSite Path Disclosure Vulnerability mailing-list
http://www.krusesecurity.dk/advisories/vis0103.txt
8075 vdb-entry
20030701 VisNetic WebSite Path Disclosure Vulnerability mailing-list
visnetic-website-path-disclosure(12483) vdb-entry