Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #226065 > unrolled thread

Re: Responsible Vulnerability Disclosure

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Responsible Vulnerability Disclosure Parshwa Bhavsar <parshwabhavsar2504@gmail.com> - 2020-08-10 17:10 +0200
    Re: Responsible Vulnerability Disclosure Dan Ritter <dsr@randomstring.org> - 2020-08-10 17:30 +0200

#226065 — Re: Responsible Vulnerability Disclosure

[Multipart message — attachments visible in raw view] — view raw

Hello there,

Is there any update on this?

On Fri, 7 Aug 2020, 12:30 am Parshwa Bhavsar, <parshwabhavsar2504@gmail.com>
wrote:

> Hello There,
> I am Parshwa Bhavsar.
> I have found a Vulnerability called "Sensitive Information Disclosure".
>
> Report :-
>
> Description :-
>
> A malicious user can have access to some admin data through this
> vulnerability.
> This vulnerability is also called "Directory Listening".
>
>
> Vulnerable URL :-
>
> http://ftp.debian.org/debian/pool/main/n/nautilus-admin/
>
>
> Steps to reproduce :-
>
> Open the vulnerable URL in your browser , you will notice that some of the
> admin files have been publicly accessed.
>
> PoC :-
> Attached ScreenShot.
>
>
> Impact :-
>
> A malicious user will use this information to plan furthermore attacks.
> It also refers to data leak to the non-authorized party.
>
>
> Mitigation:-
>
> Restrict non-authorized users to access this file.
>
> Hope, You will patch it soon :)
>
> Thanks & Regards,
> Parshwa Bhavsar
>
>

[toc] | [next] | [standalone]

#226066

Parshwa Bhavsar wrote: 
> Hello there,
> 
> Is there any update on this?
> 
> > Description :-
> >
> > A malicious user can have access to some admin data through this
> > vulnerability.
> > This vulnerability is also called "Directory Listening".
> >
> >
> > Vulnerable URL :-
> >
> > http://ftp.debian.org/debian/pool/main/n/nautilus-admin/

That's not an administrative system. That's software
distribution, for a package called "nautilus-admin".

There's no security impact here. 

-dsr-

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web