Join our followers
Installation Path Disclosure weakness in Tine 2.0
| Advisory ID: | HTB22909 |
| Product: | Tine 2.0 |
| Vendor: | Metaways Infosystems GmbH |
| Vulnerable Versions: | Neele (2011-01-2) and probably prior |
| Tested Version: | Neele (2011-01-2) |
| Advisory Publication: | March 17, 2011 [without technical details] |
| Vendor Notification: | March 17, 2011 |
| Public Disclosure: | March 31, 2011 |
| Latest Update: | March 23, 2011 |
| Vulnerability Type: | Information Exposure Through Externally-generated Error Message [CWE-211] |
| CVE Reference: | CVE-2011-1666 |
| Risk Level: | Medium |
 | |
| CVSSv2 Base Score: | 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered a weakness in Tine 2.0 which could be exploited to gain access to potentially sensitive information. | |
| Solution: | |
| Upgrade to the most recent version | |
References: | |
| [1] High-Tech Bridge Advisory HTB22909 - https://www.immuniweb.com/advisory/HTB22909 - Installation Path Disclosure weakness in Tine 2.0 [2] Tine 2.0 - tine20.org - Tine 2.0 is an open source project which combines groupware and CRM in one consistent interface. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
HTB22904: Installation Path Disclosure Weakness in bbPress
HTB22877: Installation Path Disclosure Weakness in xt:Commerce
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
