vendor:
BlogTorrent
by:
LazyCrs && pjphem
7,5
CVSS
HIGH
Password Disclosure
200
CWE
Product Name: BlogTorrent
Affected Version From: 0.92
Affected Version To: 0.92
Patch Exists: Yes
Related CWE: N/A
CPE: a:blogtorrent:blogtorrent:0.92
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2005
BlogTorrent 0.92 <= Remote/Local User Password Disclosure
A vulnerability in BlogTorrent 0.92 allows an attacker to remotely or locally disclose the username and password of a user. This is done by accessing the 'data/newusers' file which contains the username and password in MD5 format.
Mitigation:
Upgrade to the latest version of BlogTorrent and ensure that the 'data/newusers' file is not publicly accessible.
