Description
PortalApp stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 8691.mdb, a different vector than CVE-2004-1786.
References
- 20070614 ByPass In PortalApp mailing-list
- 39736 vdb-entry
- 2808 third-party-advisory
- portalapp-8691-information-disclosure(34874) vdb-entry