CVE-2006-1677

Published: Apr 11, 2006Modified: Apr 16, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php.

Affected (3)

Products: Maxdev: Md Pro

Maxdev

1 product

Md Pro

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Maxdev Md Pro	Up to 1.0.75
Maxdev Md Pro	Version 1.0.72
Maxdev Md Pro	Version 1.0.73

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (12)

http://secunia.com/advisories/19578

Source: cve@mitre.org

Vendor Advisory

http://www.maxdev.com/Article592.phtml

Source: cve@mitre.org

URL Repurposed

http://www.securityfocus.com/archive/1/430370/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/437831/100/100/threaded

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2006/1282

Source: cve@mitre.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/25714

Source: cve@mitre.org

http://secunia.com/advisories/19578