Detections
Analytics

Stronghold swish Search Script Information Disclosure

medium Nessus Plugin ID 11230

Synopsis

The remote host is affected by an information disclosure vulnerability.

Description

An information disclosure vulnerability was reported in a sample script provided with Red Hat's Stronghold web server. A remote user can determine the web root directory path.

A remote user can send a request to the Stronghold sample script swish to cause the script to reveal the full path to the webroot directory.

Apparently, swish may also display system-specific information in the HTML returned by the script

Solution

remove it

Plugin Details

Severity: Medium

ID: 11230

File Name: stronghold_swish.nasl

Version: 1.17

Type: remote

Family: CGI abuses

Published: 2/12/2003

Updated: 1/19/2021

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

Excluded KB Items: Settings/disable_cgi_scanning

Exploit Available: true

Exploit Ease: No exploit is required

Vulnerability Publication Date: 5/21/2002

Reference Information

BID: 4785