CVE-2006-0910

Invision Power Board (IPB) 2.1.4 and earlier allows remote attackers to list directory contents via a direct request to multiple directories, including (1) sources/loginauth/convert/, (2) sources/portal_plugins/, (3) cache/skin_cache/cacheid_2/, (4) ips_kernel/PEAR/, (5) ips_kernel/PEAR/Text/, (6) ips_kernel/PEAR/Text/Diff/, (7) ips_kernel/PEAR/Text/Diff/Renderer/, (8) style_images/1/folder_rte_files/, (9) style_images/1/folder_js_skin/, (10) style_images/1/folder_rte_images/, and (11) upgrade/ and its subdirectories.

Published: Feb 28, 2006
Updated: Apr 13, 2023
CVE: CVE-2006-0910
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
invision_power_services / invision_power_board	2.1_beta2	2.1_beta2.x
invision_power_services / invision_power_board	2.0.4	2.0.4.x
invision_power_services / invision_power_board	2.1_rc1	2.1_rc1.x
invision_power_services / invision_power_board	2.1.1	2.1.1.x
invision_power_services / invision_power_board	2.1.2	2.1.2.x
invision_power_services / invision_power_board	2.1.3	2.1.3.x
invision_power_services / invision_power_board	2.1_beta5	2.1_beta5.x
invision_power_services / invision_power_board	2.1.0	2.1.0.x
invision_power_services / invision_power_board	2.0.0	2.0.0.x
invision_power_services / invision_power_board	2.0.3	2.0.3.x
invision_power_services / invision_power_board	2.1_beta4	2.1_beta4.x
invision_power_services / invision_power_board	2.1_beta3	2.1_beta3.x
invision_power_services / invision_power_board	2.1.4	2.1.4.x
invision_power_services / invision_power_board	2.0.2	2.0.2.x
invision_power_services / invision_power_board	2.0.1	2.0.1.x

Vulnerability Database

289,689

CVE-2006-0910