CVE-2006-0707

Published: Feb 15, 2006Modified: Apr 16, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

PyBlosxom before 1.3.2, when running on certain webservers, allows remote attackers to read arbitrary files via an HTTP request with multiple leading / (slash) characters, which is accessed using the PATH_INFO variable.

Affected (3)

Products: Pyblosxom: Pyblosxom

Pyblosxom

1 product

Pyblosxom

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Pyblosxom Pyblosxom	Up to 1.3.1
Pyblosxom Pyblosxom	Version 1.2.1
Pyblosxom Pyblosxom	Version 1.3

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://secunia.com/advisories/18858

Source: cve@mitre.org

PatchVendor Advisory

http://sourceforge.net/project/shownotes.php?release_id=391800

Source: cve@mitre.org

Patch

http://www.securityfocus.com/bid/16641

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/0571

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/24730

Source: cve@mitre.org

http://secunia.com/advisories/18858