Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #226065

Re: Responsible Vulnerability Disclosure

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hello there,

Is there any update on this?

On Fri, 7 Aug 2020, 12:30 am Parshwa Bhavsar, <parshwabhavsar2504@gmail.com>
wrote:

> Hello There,
> I am Parshwa Bhavsar.
> I have found a Vulnerability called "Sensitive Information Disclosure".
>
> Report :-
>
> Description :-
>
> A malicious user can have access to some admin data through this
> vulnerability.
> This vulnerability is also called "Directory Listening".
>
>
> Vulnerable URL :-
>
> http://ftp.debian.org/debian/pool/main/n/nautilus-admin/
>
>
> Steps to reproduce :-
>
> Open the vulnerable URL in your browser , you will notice that some of the
> admin files have been publicly accessed.
>
> PoC :-
> Attached ScreenShot.
>
>
> Impact :-
>
> A malicious user will use this information to plan furthermore attacks.
> It also refers to data leak to the non-authorized party.
>
>
> Mitigation:-
>
> Restrict non-authorized users to access this file.
>
> Hope, You will patch it soon :)
>
> Thanks & Regards,
> Parshwa Bhavsar
>
>

Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: Responsible Vulnerability Disclosure Parshwa Bhavsar <parshwabhavsar2504@gmail.com> - 2020-08-10 17:10 +0200
  Re: Responsible Vulnerability Disclosure Dan Ritter <dsr@randomstring.org> - 2020-08-10 17:30 +0200

csiph-web