Description
eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user credentials.
References
- eyeos-usrinfo-information-disclosure(22938) vdb-entry
- 15256 vdb-entry
- http://www.thebillygoatcurse.com/advisories/eyeOS_0.8.4_Multiple.pdf
- 20411 vdb-entry
- 17105 third-party-advisory
- ADV-2005-2259 vdb-entry