Detections
Analytics
WWWBoard passwd.txt Authentication Credential Disclosure
medium Nessus Plugin ID 10321
Synopsis
The remote web server contains a CGI application that is prone to an information disclosure attack.Description
The remote host is running WWWBoard, a bulletin board system written by Matt Wright.This board system comes with a password file (passwd.txt) installed next to the file 'wwwboard.html'. An attacker may obtain the contents of this file and decode the password to modify the remote www board.
Solution
Configure the wwwadmin.pl script to change the name and location of 'passwd.txt'.See Also
Plugin Details
Severity: Medium
ID: 10321
File Name: wwwboardpwd.nasl
Version: 1.35
Type: remote
Family: CGI abuses
Published: 11/27/1999
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
Vulnerability Information
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 9/17/1999
Reference Information
CVE: CVE-1999-0953