Description
PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.
References
- 16641 vdb-entry
- pyblosxom-pathinfo-information-disclosure(24730) vdb-entry
- ADV-2006-0571 vdb-entry
- http://sourceforge.net/project/shownotes.php?release_id=391800
- 18858 third-party-advisory