Summary
The host is running TimeLive Time and Expense Tracking and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow attacker to download the complete database of users information including email addresses, usernames and passwords and associated timesheet and expense data.
Impact Level: Application
Solution
No solution or patch was made available for at least one year since disclosure of this vulnerability. Likely none will be provided anymore.
General solution options are to upgrade to a newer release, disable respective features, remove the product or replace the product by another one.
Insight
Multiple flaws are due to an error in 'FileDownload.aspx', when processing the 'FileName' parameter.
Affected
TimeLive Time and Expense Tracking version 4.2.1 and prior.
References
Severity
Classification
-
CVSS Base Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P
Related Vulnerabilities
- Apple Safari Multiple Memory Corruption Vulnerabilities-02 Aug14 (Mac OS X)
- Adobe Reader 'file://' URL Information Disclosure Vulnerability Feb07 (Mac OS X)
- Asterisk RTP Comfort Noise Processing Remote Denial of Service Vulnerability
- Apache Tomcat XML External Entity Information Disclosure Vulnerability
- Apache Tomcat Remote Code Execution Vulnerability - Sep14